Executive brief
WWBN AVideo is an open-source platform used for hosting and streaming video content. A security flaw in the platform's Live plugin allows users with streaming permissions to inject malicious scripts into the "YouTube-style" live transmission page. If a viewer or administrator visits the affected live stream page, the attacker's script can run in their browser, potentially leading to the theft of login sessions, unauthorized access to private videos, or full account takeover.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in WWBN AVideo versions 29.0 and earlier within the Live plugin. The root cause is the failure to sanitize the 'key' parameter in 'plugin/Live/view/modeYoutubeLive.php' before echoing it into an HTML class attribute. While the platform's internal sanitizers strip some characters, they do not filter double quotes or angle brackets. An attacker with 'canStream' permissions can submit a crafted stream key containing an event handler (e.g., onmouseover) or a script tag via 'plugin/Live/saveLive.php'. When any visitor (authenticated or anonymous) views the attacker's live stream page, the payload executes in the platform's origin, allowing for session cookie theft or unauthorized API actions. No patch was specified in the advisory, though the recommended fix is wrapping the output in htmlspecialchars().
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-05-11: advisory: Original GitHub security advisory published
- 2026-05-29: disclosed: CVE published to NVD