Executive brief
WWBN AVideo is an open-source video sharing platform. A security vulnerability in its call notification system allows an attacker to execute malicious code in the browsers of other online users. By simply initiating a call with a specially crafted name, an attacker can steal session cookies or take over accounts without the victim needing to click or interact with the notification.
Technical details
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the AVideo YPTSocket plugin's caller feature. The vulnerability occurs because the 'from_identification' field from a WebSocket call message is passed directly to the jQuery Toast Plugin's heading parameter, which renders it as raw HTML using the .html() method. While server-side sanitization exists for the UI, a malicious WebSocket client can bypass these checks to send arbitrary payloads. An authenticated attacker can trigger code execution on any online user's browser by initiating a call; no victim interaction is required. As of publication, no official patches are available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: GitHub Security Advisory published
- 2026-03-31: disclosed: NVD publication date