The flaw allows an unauthenticated user to join a public meeting while supplying a User‑Agent HTTP header that contains HTML or JavaScript. The raw value is stored in the meet_join_log table without any input sanitization, bypassing the framework’s xss_esc() layer. This stored cross‑site scripting is a CWE‑79 vulnerability; when a meeting host or site administrator later opens the participants panel, the stored payload is rendered and executed as enables an attacker to run arbitrary JavaScript code within that authenticated session.

The vulnerability affects the AVideo Meet plugin in the AVideo application. All released versions that include the commit e8d6119f3cb1b849149906efeb0a41fc024f59f8 before the patch have been identified as vulnerable. No specific version range is listed, so every pre‑patch installation is potentially impacted.

The CVSS score of 5.1 indicates moderate severity. The EPSS score of < 1% shows a very low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is remote, via a crafted HTTP meeting request, an attacker can act anonymously to inject the payload, which will later execute when an authorized user views the participants panel.