Executive brief
AVideo is an open-source video hosting platform. The YPTSocket plugin, which powers real-time features like live viewer counts and chat, contains a vulnerability that allows attackers to inject and execute malicious JavaScript code in any user's browser without authentication or user interaction. An attacker can hijack admin accounts, steal sessions, modify site content, or redirect users to malicious sites.
Technical details
This is a cross-site scripting (XSS) vulnerability in the YPTSocket plugin's WebSocket callback mechanism. The vulnerability stems from three compounding issues: (1) the unauthenticated WebSocket endpoint in plugin/YPTSocket/getWebSocket.json.php issues credentials to anyone without validation, (2) the WebSocket handler in plugin/YPTSocket/script.js accepts arbitrary callback names from remote peers and resolves them against global window functions, relying only on a denylist to block native functions like eval() and setTimeout(), and (3) AVideo defines a vulnerable global function avideoConfirmHTML() that assigns untrusted msg data directly to innerHTML. An unauthenticated attacker can send crafted WebSocket messages with callback:"avideoConfirmHTML" and msg set to arbitrary HTML/JavaScript, achieving script execution in any victim's browser in AVideo's origin without authentication or interaction. This affects all users, including administrators. No patch is currently available.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-08-21: disclosed: GitHub Security Advisory GHSA-xpx7-h2x7-59qq published
- 2026-09-05: advisory: CVE-2026-86188 assigned and published on NVD