CVE-2026-85159
Last modified
CVE-2026-85159 is a medium-severity vulnerability rated 5.4/10 on the CVSS scale. AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button..
Description
AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
Affected Software
Source: CNA advisory (CVE.org). NVD analysis pending.
| Vendor | Product | Versions |
|---|---|---|
| WWBN | AVideo | <= c91b5975d |
References
Timeline
- Published
- Last Modified
- Status
- Received
Frequently Asked Questions
What is CVE-2026-85159?
How severe is CVE-2026-85159?
How do I fix CVE-2026-85159?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-85150A NULL pointer dereference flaw was found in GStreamer's RTS…7.5
- CVE-2026-85154WWBN AVideo contains an authentication failure vulnerability…9.8
- CVE-2026-85155WWBN AVideo contains a SQL injection vulnerability in the so…7.5
- CVE-2026-85156WWBN AVideo fails to properly validate access controls on th…5.3
- CVE-2026-85157WWBN AVideo contains a broken access control vulnerability i…5.3
- CVE-2026-85158AVideo through commit c91b5975d contains a reflected cross-s…5.4
- CVE-2026-8516Insufficient validation of untrusted input in DataTransfer i…5.3
- CVE-2026-85160AVideo through commit c91b5975d contains a cross-site reques…8.1
- CVE-2026-85161AVideo through commit c91b5975d contains a cross-site reques…4.3
- CVE-2026-85162AVideo through commit c91b5975d contains a cross-site reques…6.5
- CVE-2026-85163AVideo through commit c91b5975d contains a server-side reque…6.5
- CVE-2026-85164WWBN AVideo through commit c91b5975d contains a server-side …7.1
Are you affected by CVE-2026-85159?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST