Description

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-05T13:18:13.843Z",
  "pubdate": "2026-09-05T13:18:13.843Z",
  "executiveSummary": "The YPTSocket plugin within the AVideo platform is susceptible to an unauthenticated Cross-Site Scripting (XSS) vulnerability. This flaw arises from the improper handling of websocket messages, enabling an attacker to inject arbitrary JavaScript that executes within the context of a victim's browser session. By manipulating the websocket callback mechanism, an unauthenticated actor can force the application to execute malicious payloads. The impact is significant, as it facilitates account takeover, session hijacking, and the unauthorized execution of actions on behalf of authenticated users without requiring any direct interaction from the victim. The vulnerability is exploitable remotely, posing a severe risk to the integrity and confidentiality of the AVideo platform and its user base. Because the exploit vector bypasses traditional authentication controls, it represents a critical security oversight in the socket communication interface.",
  "technicalDetails": "The vulnerability resides in the interaction between the YPTSocket plugin and the client-side JavaScript execution environment in AVideo. The websocket interface accepts incoming messages that specify a callback function name. If the provided callback name resolves to a global function—such as avideoConfirmHTML—that performs an assignment to an innerHTML property using unsanitized user-supplied data, a DOM-based Cross-Site Scripting condition is met.\nThe attack flow initiates when an unauthenticated attacker establishes a websocket connection to the AVideo server. The attacker crafts a malicious JSON-formatted message containing an arbitrary callback identifier and a payload string. This message is routed through the YPTSocket plugin's message handling logic, which fails to validate or sanitize the callback destination or the associated parameters.\nUpon receipt, the client-side JavaScript environment parses the socket message and resolves the attacker-specified callback. By targeting functions like avideoConfirmHTML, the malicious payload is dynamically injected into the Document Object Model (DOM). Since the browser treats this injected script as originating from the legitimate AVideo origin, it executes with full access to the victim's session cookies, localStorage, and document content.\nBecause the YPTSocket interface does not require authentication or authorization checks before processing these callbacks, an attacker can broadcast these malicious messages to any connected client. This mechanism effectively turns the websocket communication channel into a vector for remote code execution within the victim's browser context. The lack of input validation on the callback mechanism is the root cause, allowing for the bypass of security headers or standard sanitization routines that might otherwise protect individual page elements.\nPost-exploitation impact includes the ability to exfiltrate sensitive user data, modify the state of the user's account, perform unauthorized administrative actions, or inject persistent malware via further DOM manipulation. The attack remains silent, requiring no user interaction, as the vulnerability is triggered automatically upon the processing of the malicious websocket message by the victim's browser."
}