CVE-2026-43878: WWBN AVideo reflected XSS in Meet plugin iframe

Executive brief

AVideo, an open-source video sharing platform, contains a security flaw in its meeting plugin. An attacker can create a malicious link that, when clicked by a user, executes unauthorized code in their web browser. This could allow the attacker to steal login sessions, take over user accounts, or perform actions on the platform as if they were the victim.

Technical details

A reflected cross-site scripting (XSS) vulnerability exists in AVideo <= 29.0 within the 'Meet' plugin. The component 'plugin/Meet/iframe.php' reflects the 'user' and 'pass' query parameters into a JavaScript string literal without proper escaping or sanitization. An unauthenticated attacker can craft a URL that breaks out of the JavaScript string to execute arbitrary code in the context of the victim's session. This is reachable on any installation with a public, password-less meeting schedule. A fix involving JSON encoding at the sink and rawurlencode in the credential helper is recommended.

Affected products

• WWBN AVideo (formerly YouPHPTube) <= 29.0

Timeline

• 2026-04-25: disclosed: Vulnerability reported to vendor
• 2026-05-05: advisory: GitHub Advisory published

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D