CVE-2026-86188 Details
Description
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.
A cross-site scripting vulnerability has been identified in AVideo versions through 29.0, specifically when the YPTSocket plugin is enabled. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript in the browsers of other users, including administrators. The issue arises from the websocket callback mechanism, where attackers can send crafted socket messages that exploit global functions accepting untrusted data, such as avideoConfirmHTML. This function, when invoked, assigns the data to innerHTML, leading to script execution in the victim's browser without any authentication or user interaction.
Users are advised to disable the YPTSocket plugin until a patch is available. AVideo should implement a whitelist for websocket callbacks, ensuring that only safe functions can be invoked by remote peers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-xpx7-h2x7-59qq | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-xpx7-h2x7-59qq | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/avideo-yptsocket-plugin-unauthenticated-cross-site-scripting | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 29.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 8, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |