Stored XSS in LoginControl Plugin via Unencoded PGP Keys

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a stored cross-site scripting vulnerability in the LoginControl plugin that fails to HTML-encode PGP public keys echoed into a textarea element. An authenticated attacker can inject malicious JavaScript by submitting a crafted public key, which executes in an administrator's session when viewing the user's profile tab.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-89255 is a stored cross-site scripting (XSS) vulnerability in the AVideo LoginControl plugin that fails to properly HTML-encode PGP public keys before displaying them in textarea elements. This vulnerability allows authenticated attackers to inject malicious JavaScript payloads through crafted public key submissions. When an administrator views the attacker's user profile tab, the injected script executes in the administrator's browser session with full administrative privileges. This is particularly dangerous because it enables account compromise, privilege escalation, and lateral movement within the AVideo platform, affecting any organization using vulnerable versions of AVideo.

Casky's 323 matched security skills leverage Claude AI with extended reasoning to detect the attack patterns behind this CVE by mapping to MITRE ATT&CK techniques TA0001 (Reconnaissance) and TA0043 (Reconnaissance). Practitioners using Casky would identify detection signals including: malicious payload crafting during the reconnaissance phase (adversaries probing for input validation weaknesses), suspicious PGP key submissions with script tags or event handlers embedded in seemingly legitimate cryptographic material, and abnormal administrator session activity following profile tab access. The platform's skills enable practitioners to recognize the full attack chain—from initial authenticated access through payload injection to execution in privileged contexts—helping security teams prioritize remediation and implement input validation controls to prevent stored XSS attacks at the data layer.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89255.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-89255

Casky has 323 skills that investigate the attack patterns behind CVE-2026-89255. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn