Executive brief
WWBN AVideo, an open-source video sharing platform, contains a security flaw in its real-time messaging system. An authenticated user can send a specially crafted message that executes malicious code in the browsers of other connected users. This could allow an attacker to hijack user accounts, steal sensitive session information, or perform unauthorized administrative actions by impersonating other users.
Technical details
A Stored Cross-Site Scripting (XSS) vulnerability exists in WWBN AVideo versions 29.0 and below within the MessageSQLite.php WebSocket handler. The application attempts to sanitize messages by stripping the 'autoEvalCodeOnHTML' parameter from the '$json[msg]' object; however, the 'msgToResourceId()' function prioritizes the '$msg[json]' key, which remains unsanitized. An authenticated attacker can bypass security filters by placing a malicious JavaScript payload inside the 'json' key of a WebSocket message. When delivered to a victim, the payload is automatically executed by the client-side WebSocket handler. This can lead to session hijacking, credential theft, and CSRF-based administrative actions. A patch has been developed to implement recursive sanitization but may not be included in all official releases yet.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-05-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date