CVE-2026-60092: AVideo Meet Plugin Stored XSS in Participants Panel

Technical summary

The vulnerability stems from a two-stage bypass of AVideo's XSS protection mechanisms. The getMeetInfo.json.php endpoint accepts HTTP User-Agent headers from meeting participants and stores the raw value in the meet_join_log.user_agent database field. This storage layer bypasses the setter-level xss_esc() function that normally sanitizes user input. When administrators or hosts access the Participants management panel, the stored User-Agent is retrieved and rendered via echo without htmlspecialchars() encoding, allowing arbitrary HTML and JavaScript to execute. The attack surface is broad because any anonymous user can join public meetings without authentication. The vulnerability persists through at least commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 and remained unpatched at disclosure.

Business impact

A compromised meeting administrator or host account can be leveraged to gain elevated access across the AVideo installation. An attacker's JavaScript executes with the privileges of the logged-in administrator, potentially allowing credential theft, unauthorized meeting creation or deletion, recording access, or further lateral movement. For organizations using AVideo for sensitive meetings, this creates a vector for social engineering and privilege escalation. The attack is silent—the host may not realize their session has been compromised when viewing a participant list.

Affected systems

AVideo installations with the Meet plugin enabled and accessible to public meetings are affected. The vulnerability exists through at least commit e8d6119f3cb1b849149906efeb0a41fc024f59f8. Vendor and product version information was not available in the source data; organizations should verify their installed commit hash or version against AVideo's repository to confirm exposure.

Exploitability

Exploitability is straightforward from an attacker perspective: no authentication is required to join a public meeting and inject a malicious User-Agent header. Standard HTTP tools (curl, Burp Suite) suffice. However, the attack requires a meeting host or administrator to view the Participants panel after the injection, introducing a user-interaction requirement that reduces real-time exploitability but does not eliminate risk given the typical workflow of meeting hosts monitoring participants. The CVSS score of 6.1 (MEDIUM) reflects this balance: network accessible, low complexity, no privileges required, but dependent on end-user action.

Remediation

The underlying fix requires two controls: (1) sanitize User-Agent input at the point of storage by applying AVideo's xss_esc() function or equivalent HTML entity encoding, and (2) encode all output in the Participants panel using htmlspecialchars() or context-appropriate encoding. Alternatively, truncate or normalize User-Agent strings to a whitelist of known formats to reduce injection surface. Until a patched version is available, restrict public meeting creation to trusted users and implement network controls to limit who can access the Meet plugin endpoints.

Patch guidance

Check AVideo's official repository and security advisories for a patch version that addresses commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 or later. No specific patched version was identified in the source data; verify against the vendor advisory or upgrade to the latest stable release after confirming the fix is included. If running a fork or custom build, apply input sanitization and output encoding to getMeetInfo.json.php and any Participants display logic.

Detection guidance

Monitor application logs for HTTP requests to getMeetInfo.json.php with suspicious User-Agent headers containing HTML tags, script tags, or event handlers (e.g., onerror, onload). Inspect the meet_join_log table for stored payloads using LIKE queries for patterns such as '<', 'javascript:', or 'onerror='. Monitor administrator access to the Participants panel and correlate with injection timestamps. Web application firewalls (WAF) should block User-Agent headers containing HTML/JavaScript patterns as a preventive measure. Audit meeting participant logs for anomalous join patterns from the same network range.

Why prioritize this

Although CVSS assigns MEDIUM severity, the vulnerability should be prioritized because it directly compromises administrator accounts, which are high-value targets for lateral movement and persistent access. The low barrier to exploitation (any public meeting, no authentication) and silent nature of the attack make it attractive to threat actors. Organizations running AVideo in sensitive environments (healthcare, finance, legal) should treat this as urgent. The lack of a known patch at disclosure increases priority.

Risk score, explained

CVSS 3.1 score of 6.1 reflects a network-accessible vulnerability with low attack complexity and no privilege requirements (attacker vectors), but limited confidentiality and integrity impact scoped to the Participants panel display. The user-interaction requirement (UI:R) prevents a higher score, as the host must open the panel to trigger execution. However, this does not diminish the actual risk to administrative accounts; organizations should weight their own exposure (prevalence of public meetings, administrator attentiveness) when determining internal severity.

Frequently asked questions