WWBN AVideo CVE-2026-86188

The YPTSocket plugin must be installed and enabled on the AVideo instance - this is a non-default optional plugin, not part of the core AVideo installation, which limits the exposed population. Beyond that single configuration prerequisite, no other conditions limit exploitation: the WebSocket endpoint is accessible without authentication (PR:N), requires no crafted timing or race conditions (AC:L), and does not require the victim to take any action beyond already having the AVideo application open in their browser with an active WebSocket connection. Exploitation is limited to users actively connected to the WebSocket session at the time the crafted message is injected. The attacker must be able to reach the AVideo server's WebSocket port over the network.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/SC:L/SI:L/SA:N reflects a realistic picture: network-reachable, no prerequisites, no victim click required, but impact bounded to the subsequent (victim browser) system with low confidentiality and integrity ratings. No public exploit code has been identified at the time of analysis, and this CVE is not listed in the CISA KEV catalog, making opportunistic mass exploitation less likely than for KEV-listed issues. The practical risk is session hijacking, credential theft via injected forms, or forced actions on behalf of authenticated users - meaningful for any deployment where AVideo handles sensitive content or authenticated sessions. The non-default plugin requirement (YPTSocket must be explicitly enabled) materially reduces the exposed population relative to the raw CVSS score suggests, so operators should audit whether YPTSocket is active before treating this as a universal emergency. No EPSS score was provided, and no conflicting data signals were detected.

An unauthenticated attacker connects to AVideo's WebSocket endpoint exposed by the YPTSocket plugin and sends a crafted message specifying avideoConfirmHTML (or another global function that writes to innerHTML) as the callback name, with a malicious HTML payload containing a JavaScript keylogger as the data. Any user whose browser is currently connected to the same WebSocket session receives and processes the message, executing the injected script within AVideo's origin and exfiltrating session cookies or credentials to the attacker's server. No public exploit code has been identified, but the mechanism is straightforward and requires only a WebSocket client.