CVE-2026-40911 Details
Description
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix.
A vulnerability in the YPTSocket plugin for WWBN AVideo, in versions through 29.0, allows for unauthenticated cross-user JavaScript execution. The WebSocket server relays attacker-supplied JSON messages to all connected clients without sanitizing the 'msg' or 'callback' fields. This exploitation occurs through two 'eval()' sinks in the client-side script, leading to session theft and unauthorized actions on behalf of the affected users, including administrators.
Users can update to the latest version of AVideo, where this vulnerability has been addressed. Instructions for updating can be found in the AVideo documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-94 | Improper Control of Generation of Code ('Code Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |