Cross-Site Scripting Vulnerability in AVideo Video-Sharing Platform
CVE-2026-61573

6.1MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo-encoder
Vendor
CVE Published:
28 October 2026

What is CVE-2026-61573?

AVideo, a video-sharing platform, contains a significant cross-site scripting vulnerability. Versions prior to 8.1.0 allow unauthenticated remote attackers to exploit the application by persuading victims to click on specially crafted login links. This can lead to the execution of arbitrary JavaScript in the user's browser, which may expose sensitive information such as session identifiers and credentials. The affected components include the login interface, where values are improperly reflected in HTML and JavaScript. The vulnerability is patched in version 8.1.0, emphasizing the importance of updating to safeguard against potential exploitation.

Affected Version(s)

AVideo-Encoder < 8.1.0

References

https://github.com/WWBN/AVideo-Encoder/security/advisorie...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo-Encoder/commit/789d75681cc...
x_refsource_MISC
https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0
x_refsource_MISC

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.