Executive brief
The Meet plugin for AVideo, a video sharing and streaming platform, is vulnerable to a security flaw where an unauthenticated user can inject malicious code into the administrator's dashboard. By joining a public meeting with a specially crafted browser identifier, an attacker can execute scripts in the context of a site administrator's session. This could allow the attacker to take over administrative accounts, steal sensitive session information, or perform unauthorized actions on the platform.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in the AVideo Meet plugin due to insufficient output encoding of participant metadata. The application logs the raw HTTP User-Agent header of meeting participants in the 'meet_join_log' table without sanitization. When a meeting host or site administrator views the 'Participants' panel, the 'getMeetInfo.json.php' endpoint retrieves these logs and reflects the 'user_agent' value directly into the HTML response. Because the frontend uses jQuery's '.html()' method to render this data, an unauthenticated attacker can join a public meeting with a malicious User-Agent string to execute arbitrary JavaScript in the context of a privileged user. The vulnerability is present in versions up to 29.0 and was identified at commit e8d6119.
Affected products
- WWBN AVideo Meet Plugin <= 29.0
Timeline
- 2026-06-22: advisory: Advisory published on GitHub