Executive brief
WWBN AVideo, an open-source video sharing platform, contains a security flaw in its YPTSocket plugin. An unauthenticated attacker can inject malicious scripts that automatically execute in the browsers of site administrators. This allows the attacker to hijack administrative sessions, steal sensitive data, and gain full control over the video platform.
Technical details
A stored DOM Cross-Site Scripting (XSS) vulnerability exists in the YPTSocket plugin of WWBN AVideo due to improper validation of WebSocket connection parameters. An unauthenticated attacker can obtain a signed WebSocket token via 'getWebSocket.json.php' and connect to the WebSocket server with malicious 'webSocketSelfURI' and 'page_title' query parameters. These values are persisted in an in-memory SQLite table and broadcast to all connected clients. On the client side, 'script.js' interpolates the 'page_title' into an HTML template literal and passes it to the jQuery '.append()' sink without sanitization. If an administrator is viewing a page with the YPTSocket debug panel enabled, the injected script executes in their authenticated context, enabling session hijacking and full site takeover. This issue is patched in version 29.0.
Affected products
- WWBN AVideo Prior to 29.0
Timeline
- 2026-06-04: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date