CVE-2026-86188

Name of the Vulnerable Software and Affected Versions AVideo (affected versions not specified)

Description When the YPTSocket plugin is enabled, a cross-site scripting issue exists via the websocket callback mechanism. Unauthenticated attackers can execute arbitrary JavaScript in the browsers of other users by sending crafted socket messages. This occurs when callback names resolve to global functions, such as avideoConfirmHTML(), which accept untrusted data and assign it to innerHTML, allowing script execution in the victim's origin without authentication or user interaction.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.