WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix.
Fix
Patch, vendor advisory and mitigation references on NVD 3
- https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr Exploit, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr Exploit, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 10.0 · wwbnNVD modified 2026-10-26 22:10
Affected (CPE criteria) 1
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
References 3
- https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr Exploit, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr Exploit, Vendor Advisory