# CVE-2026-89255: AVideo LoginControl stored XSS in PGP public key

Source: https://junglewise.ai/threats/cve-2026-89255-avideo-logincontrol-stored-xss-in-pgp-public-key  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-11. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-89255 · Severity: high · CVSS 8.7 · Published 2026-09-11

AVideo is a video hosting and streaming platform. The LoginControl plugin stores user-submitted PGP public keys without sanitization and displays them to administrators. An authenticated attacker can inject malicious JavaScript into a crafted public key that executes with administrative privileges when an admin views the attacker's user profile, potentially allowing the attacker to steal sensitive data, modify content, or compromise administrator accounts.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-89255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-89255 being exploited in the wild.

**How severe is CVE-2026-89255?** High severity, with a CVSS score of 8.7, published 11 September 2026.

**Which products and versions are affected?** WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

**Is there a fix for CVE-2026-89255?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-89255 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-89255?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in AVideo's LoginControl plugin. The vulnerability exists because the plugin stores user-supplied PGP public keys without HTML encoding in the savePublicKey.json.php endpoint and later echoes them unencoded into a textarea element on the admin profile tab (profileTabContent.php). An authenticated attacker can submit a malicious payload (e.g., `</textarea><img src=x onerror=alert(document.domain)>`) that breaks out of the textarea and executes arbitrary JavaScript when an administrator opens the user's LoginControl profile tab. The attack requires the attacker to have a valid user account and the administrator to visit the affected user's profile page. No patch was available at the time of reporting.

## Affected products

- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1

## Timeline

- 2026-08-27: disclosed: GitHub Security Advisory GHSA-gq4h-vw2w-9rx3 published
- 2026-09-11: advisory: CVE-2026-89255 assigned

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-gq4h-vw2w-9rx3](https://github.com/WWBN/AVideo/security/advisories/GHSA-gq4h-vw2w-9rx3)
- [https://www.vulncheck.com/advisories/avideo-logincontrol-stored-xss-via-pgp-public-key](https://www.vulncheck.com/advisories/avideo-logincontrol-stored-xss-via-pgp-public-key)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)