Executive brief
WWBN AVideo is a video hosting and streaming platform. The LoginControl plugin stores unencoded User-Agent headers in login history and displays them in the administrator dashboard without sanitization. An attacker with any valid user account can inject malicious JavaScript into their User-Agent header that executes in the administrator's browser when the administrator views the login history page, allowing theft of administrator session data and administrative actions.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the LoginControl plugin's login history feature. The root cause is that LoginControl::createLog() (plugin/LoginControl/LoginControl.php:151-166) writes the $_SERVER['HTTP_USER_AGENT'] header directly to the database via logincontrol_history::setUser_agent() without encoding. When administrators view the Login History page, the DataTable renders user_agent column content with innerHTML, causing stored malicious scripts to execute. An attacker with a valid login can inject JavaScript (e.g., User-Agent: <img src=x onerror=alert(document.domain)>) that will execute whenever an administrator accesses the login history page, enabling session hijacking and account takeover. The vulnerability requires network access, valid authentication, and administrator user interaction to view the history page. No patch was available at the time of reporting.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-wg67-62q3-2m33 published
- 2026-09-10: advisory: CVE-2026-88866 published on NVD