AVideo CVE-2026-40911

The YPTSocket plugin must be enabled (it ships bundled and its real-time features are commonly used), and the target's WebSocket endpoint plus getWebSocket.json.php must be reachable by the attacker; no authentication is required because tokens are minted for anonymous visitors (from_users_id=0, isAdmin=false) and accepted on decryption alone (CVSS PR:N confirms unauthenticated). The one real limiting factor is that impact is scoped to users who are connected to the WebSocket at the moment of the broadcast - the injected JavaScript executes in currently-connected clients, so an attacker maximizes value by broadcasting while an administrator or many viewers are online (e.g., during a live stream). No user interaction beyond a victim having the page open is needed (UI:N), and no non-default configuration is required other than the plugin being active.

The signals are strongly aligned toward high real-world severity. CVSS 3.1 base is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) - network-reachable, low complexity, no privileges, no user interaction, with a scope change reflecting that code executes in other users' browsers. SSVC reinforces this: exploitation=PoC, Automatable=yes, Technical Impact=total. The one moderating signal is EPSS at 0.17% (38th percentile), which is low; this reflects that mass exploitation has not yet been observed at scale, not that difficulty is high - the low complexity and public PoC mean the EPSS figure is likely to lag the true ease of exploitation rather than contradict it. It is NOT in CISA KEV, so there is no confirmation of active in-the-wild exploitation. Net: this is a genuine high priority for any internet-exposed AVideo instance with YPTSocket enabled, not a high-CVSS-but-low-real-risk case; the main uncertainty is whether an attacker actively targets a given deployment given the product's moderate footprint.

An anonymous attacker requests a WebSocket token from getWebSocket.json.php (granted because the plugin is enabled), connects to the YPTSocket server, and broadcasts a JSON message containing a malicious callback value or a msg.autoEvalCodeOnHTML payload. The server relays it unmodified to every connected client, whose script.js passes it into eval(), so the attacker's JavaScript runs in the browser of every current viewer and administrator - stealing sessions and issuing privileged admin actions. This is automatable (SSVC Automatable=yes) and a proof-of-concept is reported to exist.