---
id: CVE-2026-85159
title: >-
  AVideo through commit c91b5975d contains a reflected cross-site scripting
  vulnerability in userLogin.php where the cancelUri parameter is echoed in an
  href attribute after isSafeRedirectURL checks protocol only, not HTML
  characters
summary: >-
  AVideo through commit c91b5975d contains a reflected cross-site scripting
  vulnerability in userLogin.php where the cancelUri parameter is echoed in an
  href attribute after isSafeRedirectURL checks protocol only, not HTML
  characters. Unau…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'
cwe:
  - CWE-79
published: '2026-09-03'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T20:18:59.270'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85159'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/avideo-reflected-xss-via-canceluri-in-userlogin-php
    label: disclosure@vulncheck.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-mw3g-2292-vw4c'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00168
epssPercentile: 0.06546
ingestedAt: '2026-09-05T20:44:36.099Z'
---

## Overview

AVideo through commit c91b5975d contains a reflected cross-site scripting vulnerability in userLogin.php where the cancelUri parameter is echoed in an href attribute after isSafeRedirectURL checks protocol only, not HTML characters. Unauthenticated attackers can inject event handlers via relative URLs with embedded quotes to execute arbitrary JavaScript when users interact with the Cancel button.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.