AVideo has Reflected XSS via unlockPassword Parameter in forbiddenPage.php and warningPage.php
Date: 2026-03
Affected: composer/wwbn/avideo
Attack vector: xss
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-33499
CWE: CWE-79
CVSS: 6.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)

## Summary The `view/forbiddenPage.php` and `view/warningPage.php` templates reflect the `$_REQUEST['unlockPassword']` parameter directly into an HTML `<input>` tag's attributes without any output encoding or sanitization. An attacker can craft a URL that breaks out of the `value` attribute and injects arbitrary HTML attributes including JavaScript event handlers, achieving reflected XSS against any visitor who clicks the link. ## Details When a user visits a password-protected channel, `view/channel.php:22` calls: ```php forbiddenPage('This channel is password protected', false, $channelPassword); ``` The `forbiddenPage()` function in `objects/functionsSecurity.php:520` checks whether the supplied password matches. If it doesn't (or no password was submitted), it includes `view/forbiddenPage.php` at line 561. In `view/forbiddenPage.php:31-35`, the raw request parameter is reflected into HTML: ```php $value = ''; if (!empty($_REQUEST['unlockPassword'])) { $value = $_REQUEST['unlockPassword']; // Line 33: unsanitized user input } echo getInputPassword('unlockPassword', 'class="form-control" value="' . $value . '"', __('Unlock Password')); ``` The `getInputPassword()` function at `objects/functions.php:4490` outputs the `$attributes` string directly into the `<input>` tag at line 4502: ```php <input id="<?php echo $id; ?>" name="<?php echo $id; ?>" type="password" placeholder="<?php echo $placeholder; ?>" <?php echo $attributes; ?>> ``` The `unlockPassword` paramete


Mitigations:

Architectural layers (MAESTRO):