Is CVE-2026-49279 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49279 being exploited in the wild.

How severe is CVE-2026-49279?

High severity, with a CVSS score of 4, published 15 July 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.

Is there a fix for CVE-2026-49279?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49279 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-49279?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49279: WWBN AVideo Stored XSS in MessageSQLite WebSocket handler

Q: Is there a fix for CVE-2026-49279?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-49279 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-49279?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49279 · Severity: high · CVSS 4 · Published 2026-07-15

WWBN AVideo, an open-source video sharing platform, contains a security flaw in its real-time messaging system. An authenticated user can send a specially crafted message that executes malicious code in the browsers of other connected users. This could allow an attacker to hijack user accounts, steal sensitive session information, or perform unauthorized administrative actions by impersonating other users.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-49279 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49279 being exploited in the wild.
How severe is CVE-2026-49279?: High severity, with a CVSS score of 4, published 15 July 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.
Is there a fix for CVE-2026-49279?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49279 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-49279?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in WWBN AVideo versions 29.0 and below within the MessageSQLite.php WebSocket handler. The application attempts to sanitize messages by stripping the 'autoEvalCodeOnHTML' parameter from the '$json[msg]' object; however, the 'msgToResourceId()' function prioritizes the '$msg[json]' key, which remains unsanitized. An authenticated attacker can bypass security filters by placing a malicious JavaScript payload inside the 'json' key of a WebSocket message. When delivered to a victim, the payload is automatically executed by the client-side WebSocket handler. This can lead to session hijacking, credential theft, and CSRF-based administrative actions. A patch has been developed to implement recursive sanitization but may not be included in all official releases yet.

Affected products

WWBN AVideo <= 29.0

Identifiers

CVE-2026-49279
GHSA-2fhx-q92v-5fhv

Timeline

2026-05-25: advisory: GitHub Security Advisory published
2026-07-15: disclosed: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.