CVE-2026-88866

CVSS 9.3 (critical) · published 2026-09-10

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to encode the User-Agent header before storing it in login history. Attackers with any valid login account can inject malicious scripts in the User-Agent header that execute in administrator browsers when viewing the Login History page, allowing script execution within the administrator session.

Weakness: CWE-79

Source: NVD CVE-2026-88866

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33
• https://www.vulncheck.com/advisories/wwbn-avideo-logincontrol-stored-xss-via-user-agent-header
• https://github.com/WWBN/AVideo/security/advisories/GHSA-wg67-62q3-2m33

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.