WWBN AVideo
CVE-2026-54458
CRITICAL
GHSA-8whc-2wmv-ww35
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
ReconRequest signed WebSocket token anonymously
-
DeliveryOpen WebSocket with malicious page_title
-
ExploitMetadata stored and broadcast to clients
-
InstallAdmin renders online-users debug panel
-
C2jQuery append executes injected script
-
ExecuteSteal admin cookies and CSRF token
-
ImpactIssue authenticated admin requests
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the target AVideo installation has the YPTSocket plugin enabled (the token endpoint only checks AVideoPlugin::isEnabledByName('YPTSocket')) and that a victim administrator is actively viewing a page that renders the YPTSocket online-users debug panel - this rendering of the online-users card via updateSocketUserCard is the trigger. The attacker needs no account or authentication (PR:N) and only a network path to the WebSocket endpoint. Limiting factors: the payload only fires when an admin has that specific debug panel open (UI:R), so environments that do not surface the YPTSocket online-users panel to admins are not exploitable; success is scoped to administrators currently connected, and impact leverages non-HttpOnly cookies plus the CSRF token being present in the admin dashboard DOM. |
| Impact | The signals are largely aligned toward high real-world risk. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L (9.6 Critical) reflects network reach, no attacker privileges (PR:N - unauthenticated), and a scope change (S:C) because code executes in the higher-privileged admin origin, yielding high confidentiality and integrity impact (session/CSRF-token theft and authenticated admin actions). The one meaningful brake is UI:R plus a deployment precondition: an administrator must actively be viewing the YPTSocket online-users debug panel for the payload to fire - this is not a default-facing page, which reduces the population of exploitable targets. There is no CISA KEV listing and no EPSS score provided, and no public POC is referenced, so this is not confirmed as actively exploited - the priority rests on severity and the low technical barrier to sending the WebSocket connection, not on observed in-the-wild activity. Net assessment: a genuine high priority for any AVideo deployment that runs the YPTSocket plugin with the debug panel exposed to admins, somewhat lower for those that do not render that panel. |
| Exploit ScenarioDerived | An anonymous attacker requests a WebSocket token from getWebSocket.json.php, then opens a WebSocket connection with a page_title query parameter containing an <img onerror=...> payload. When an administrator has the YPTSocket online-users debug panel open, the broadcast metadata renders the payload in the admin's authenticated origin, letting the attacker steal the admin's CSRF token and cookies and issue admin-only requests. No public POC is referenced, but the low attack complexity (AC:L) and unauthenticated network access (PR:N) make weaponization straightforward. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 15, 2026
Stored DOM cross-site scripting in WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) lets any unauthenticated remote attacker run arbitrary JavaScript in the browser session of any administrator viewing the YPTSocket online-users debug panel. Because the malicious WebSocket metadata is broadcast to every connected client and rendered without escaping, a single anonymous WebSocket connection can be escalated into full administrative account takeover via the admin's own session and CSRF token. No public exploit identified at time of analysis; the flaw carries a CVSS 9.6 (Critical) rating driven by the scope change into the privileged admin origin.
RemediationAI
Upgrade AVideo to version 29.0 or later, which includes the fix from commit 8be71e53ccbe9b84b30870db386fb4d2b11e1c16; that commit HTML-escapes page_title via htmlspecialchars(..., ENT_QUOTES | ENT_HTML5, 'UTF-8') and restricts webSocketSelfURI to validated http/https URIs (rejecting javascript: injection). If you cannot patch immediately, disable the YPTSocket plugin entirely (AVideoPlugin disable) to remove both the anonymous token endpoint and the vulnerable broadcast path - trade-off: this removes real-time online-user presence features. As a narrower mitigation, ensure administrators are not left viewing the YPTSocket online-users debug panel and restrict/monitor access to the plugin's WebSocket endpoint, though this does not remove the underlying flaw. Review the vendor advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35 for guidance. Because the payload steals non-HttpOnly cookies and CSRF tokens, rotate admin session credentials after patching if compromise is suspected.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
AVideo is an open-source PHP video-streaming platform. The YPTSocket plugin provides a WebSocket-based real-time online-users feature. The root cause is CWE-79 (improper neutralization of input during web page generation). The token endpoint plugin/YPTSocket/getWebSocket.json.php gates only on the plugin being enabled (AVideoPlugin::isEnabledByName), so it hands a signed WebSocket token to any anonymous caller. On connection, MessageSQLiteV2::onOpen (lines 91 and 110) copies the attacker-controlled webSocketSelfURI and page_title query parameters verbatim into the in-memory SQLite connections table - page_title is only passed through utf8_encode, which is an encoding transform, not HTML escaping. dbGetUniqueUsers() then selects those columns unescaped into the users_id_online array that msgToResourceId() broadcasts to every client. Client-side, plugin/YPTSocket/script.js::updateSocketUserCard interpolates page_title into an HTML template literal handed to jQuery $.append(html), which parses the attacker bytes into live DOM nodes (e.g., <img> with inline event handlers). The affected product is identified by CPE cpe:2.3:a:wwbn:avideo:*.
Know when Avideo gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Unauthenticated network delivery (PR:N/AV:N) with low-complexity injection; UI:R because an admin must view the debug panel; S:C as script runs in the higher-privileged admin origin giving C:H/I:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
DescriptionCVE.org
WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including <img> with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16.
Executive ViewAI
WWBN AVideo's YPTSocket plugin (all versions prior to 29.0) contains a critical stored XSS vulnerability enabling unauthenticated attackers to hijack administrator sessions and seize complete control of the video platform. No public exploit identified at time of analysis, but any administrator accessing the debug panel remains vulnerable to account takeover and exposure of user data, content, and platform configuration. With no vendor patch currently available, organizations running AVideo face immediate operational risk requiring urgent mitigation.
Disable YPTSocket plugin entirely if not operationally critical; restrict debug panel access to whitelisted administrative IP ranges via firewall or reverse proxy; implement continuous monitoring of WebSocket connections and administrator account activity for unauthorized access; enforce multi-factor authentication on all administrator accounts; deploy Web Application Firewall rules to block XSS patterns in network traffic; conduct regular audits of administrator account activity and session logs for signs of compromise.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
Cross-Site Request Forgery exploits the automatic credential inclusion behavior of web browsers.
Affected Products (CPE)CVE.org
A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.
An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit
An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed
Unauthenticated SQL injection in AVideo before 24.0.
OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit
A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.
A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and
A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co
An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi
WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable
AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low
Exploit-DB