Executive brief
WWBN AVideo is an open-source platform used for hosting and sharing video content. A security flaw in its User_Location plugin allows attackers to execute malicious code in the browser of an administrative user. By tricking an administrator into clicking a specially crafted link, an attacker could hijack their session, modify site settings, or create unauthorized accounts.
Technical details
A reflected cross-site scripting (XSS) vulnerability exists in the User_Location plugin's testIP.php page in WWBN AVideo versions 26.0 and prior. The 'ip' request parameter is reflected directly into an HTML input element's value attribute without proper output encoding (e.g., htmlspecialchars). While the page is restricted to administrators, the application's use of 'SameSite=None' for session cookies enables cross-origin exploitation. An attacker can lure an authenticated administrator to a malicious URL, executing arbitrary JavaScript in their session context. This can lead to session cookie theft or unauthorized administrative actions. No patches were available at the time of the advisory.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published by DanielnetoDotCom
- 2026-03-31: disclosed: CVE-2026-34739 published to NVD