What is the CVSS score of CVE-2026-40911?

CVE-2026-40911 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of AVideo are affected by CVE-2026-40911?

WWBN AVideo versions 29.0 and earlier contain a critical remote code execution vulnerability (CVE-2026-40911) allowing any visitor to inject and execute arbitrary JavaScript across all connected user…

How to fix or mitigate CVE-2026-40911?

Within 24 hours: Audit your environment to identify all WWBN AVideo deployments running version 29.0 or earlier and document exposure scope, particularly systems accessed by administrators. Immediately disable the YPTSocket WebSocket plugin or restrict anonymous socket connections if operationally feasible. Within 7 days: Implement emergency network segmentation limiting AVideo access to trusted internal networks only, deploy Web Application Firewall rules to detect and block malicious socket payloads, and configure comprehensive logging for all WebSocket messages and client-side JavaScript execution. Within 30 days: Monitor WWBN's security advisories for availability of patched versions and develop an urgent upgrade timeline; if patching cannot occur within acceptable risk tolerance, evaluate alternative video platforms. Deploy endpoint detection and response (EDR) solutions to identify indicators of exploitation including anomalous session activity, unauthorized administrative action execution, and lateral movement.

AVideo CVE-2026-40911

EUVD-2026-24479 CRITICAL

Code Injection (CWE-94)

2026-04-21 GitHub_M

GHSA-gph2-j4c9-vhhr

RCE Code Injection Avideo

10.0

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

10.0 CRITICAL

Unauthenticated network reach with no user interaction and trivial broadcast (AV:N/AC:L/PR:N/UI:N); scope changes as code runs in other users' browsers (S:C), enabling session theft and privileged admin actions (C/I/A:H).

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:04 vuln.today

Analysis Generated

Jul 24, 2026 - 07:04 vuln.today

EUVD ID Assigned

Apr 21, 2026 - 21:01 euvd

EUVD-2026-24479

CVE Published

Apr 21, 2026 - 19:55 nvd

CRITICAL 10.0

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the msg or callback fields. On the client side, plugin/YPTSocket/script.js contains two eval() sinks fed directly by those relayed fields (json.msg.autoEvalCodeOnHTML at line 568 and json.callback at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix.

AnalysisAI

Unauthenticated cross-user JavaScript execution in WWBN AVideo (versions 29.0 and prior) lets a remote attacker broadcast arbitrary code to every connected browser through the YPTSocket WebSocket plugin. Because anonymous visitors are issued valid socket tokens and the server relays the attacker-controlled msg and callback fields verbatim into client-side eval() sinks, any visitor can execute JavaScript in the origin of all connected users - including administrators - yielding universal account takeover, session theft, and privileged action execution. Publicly available exploit code exists (SSVC: PoC) though the flaw is not listed in CISA KEV, and EPSS is currently low at 0.17%.

Technical ContextAI

The affected component is the YPTSocket real-time messaging plugin bundled with AVideo (cpe:2.3:a:wwbn:avideo), which runs a Ratchet-style PHP WebSocket server (Message.php / MessageSQLite.php / MessageSQLiteV2.php) paired with a browser client (plugin/YPTSocket/script.js). The root cause is CWE-94 (Code Injection): the browser client passes two server-relayed, attacker-influenced JSON fields into eval() - json.msg.autoEvalCodeOnHTML at script.js line 568 and json.callback at line 95. autoEvalCodeOnHTML is intended as a trusted server-to-client (php-origin) feature, but the server's onMessage default branch rebroadcasts guest-supplied payloads without stripping these fields. Token issuance compounds this: getWebSocket.json.php returns an encrypted token to anyone if the plugin is merely enabled, and getEncryptedInfo() sets from_users_id=0 / isAdmin=false for guests; the onOpen handler accepts the token purely on successful decryption, so no authenticated principal is ever required.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - no tagged release version is provided in the source data, so apply commit c08694bf6264eb4decceb78c711baee2609b4efd (https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd) or the next tagged release above 29.0 that contains it, and consult the advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr. The fix strips eval-able fields from browser/guest messages: it unsets json['msg']['autoEvalCodeOnHTML'] and drops any json['callback'] that is not a valid JS identifier unless the message originates from the PHP/CLI side (isCommandLineInterface or sentFrom==='php'). If you cannot patch immediately, the most effective compensating control is to disable the YPTSocket plugin (getWebSocket.json.php only issues tokens when the plugin is enabled), which removes the attack surface entirely at the cost of losing real-time features such as live chat, viewer counts, and notifications. Alternatively, block or firewall external access to the WebSocket server port and the getWebSocket.json.php endpoint so only trusted networks can obtain tokens; this breaks real-time functionality for remote/public users. Do not rely on authentication as a control here, since token issuance and acceptance do not require authentication.