# CVE-2026-49279: WWBN AVideo Stored XSS in MessageSQLite WebSocket handler

Source: https://junglewise.ai/threats/cve-2026-49279-wwbn-avideo-stored-xss-in-messagesqlite-websocket-handler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-49279 · Severity: high · CVSS 4 · Published 2026-07-15

WWBN AVideo, an open-source video sharing platform, contains a security flaw in its real-time messaging system. An authenticated user can send a specially crafted message that executes malicious code in the browsers of other connected users. This could allow an attacker to hijack user accounts, steal sensitive session information, or perform unauthorized administrative actions by impersonating other users.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo), [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-49279 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-49279 being exploited in the wild.

**How severe is CVE-2026-49279?** High severity, with a CVSS score of 4, published 15 July 2026.

**Which products and versions are affected?** wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.

**Is there a fix for CVE-2026-49279?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-49279 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-49279?** Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in WWBN AVideo versions 29.0 and below within the MessageSQLite.php WebSocket handler. The application attempts to sanitize messages by stripping the 'autoEvalCodeOnHTML' parameter from the '$json[msg]' object; however, the 'msgToResourceId()' function prioritizes the '$msg[json]' key, which remains unsanitized. An authenticated attacker can bypass security filters by placing a malicious JavaScript payload inside the 'json' key of a WebSocket message. When delivered to a victim, the payload is automatically executed by the client-side WebSocket handler. This can lead to session hijacking, credential theft, and CSRF-based administrative actions. A patch has been developed to implement recursive sanitization but may not be included in all official releases yet.

## Affected products

- WWBN AVideo <= 29.0

## Identifiers

- CVE-2026-49279
- GHSA-2fhx-q92v-5fhv

## Timeline

- 2026-05-25: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date

## References

- [https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23](https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23)
- [https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv](https://github.com/WWBN/AVideo/security/advisories/GHSA-2fhx-q92v-5fhv)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)