Executive brief
AVideo, a popular open-source video platform, contains a vulnerability in its WebSocket communication plugin that allows an unauthenticated attacker to execute malicious code in the browsers of other logged-in users. By sending a specially crafted message, an attacker can target any active user, including administrators, to steal session data or perform unauthorized actions on their behalf. This issue exists because a previous security fix was incomplete, leaving a path for malicious scripts to bypass safety checks.
Technical details
An incomplete fix for GHSA-gph2-j4c9-vhhr in the YPTSocket plugin allows for unauthenticated Cross-Site Scripting (XSS) via a relay bypass. The server-side mitigation in `Message.php` only strips the `autoEvalCodeOnHTML` field if it resides within `$json['msg']` and if that field is an array. However, the relay function `msgToResourceId()` prioritizes the `$msg['json']` field, which is not subjected to the same stripping logic. An attacker can obtain a WebSocket token without authentication via `getWebSocket.json.php`, connect to the WebSocket server, and send a payload with the malicious script nested in the `json` field. The server relays this payload to a targeted `to_users_id`, where the client-side `script.js` executes it using `eval()`.
Affected products
- WWBN AVideo (formerly YouPHPTube) <= 29.0
Timeline
- 2026-05-05: advisory: Original advisory published on GitHub