CVE-2026-54458

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0

Description A stored DOM Cross-Site Scripting (XSS) issue exists in the YPTSocket plugin. An unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of any administrator viewing a page that renders the YPTSocket online-users debug panel. The vulnerability occurs because the endpoint "/plugin/YPTSocket/getWebSocket.json.php" issues a signed WebSocket token to anonymous callers, and the function MessageSQLiteV2::onOpen in "plugin/YPTSocket/MessageSQLiteV2.php" reads the webSocketSelfURI and page title query parameters from the WebSocket connection URL without validation. These values are stored in an in-memory SQLite table and broadcast to connected clients. On the client side, the function updateSocketUserCard in "plugin/YPTSocket/script.js" interpolates the page title into an HTML template passed to jQuery $.append(), allowing the browser to parse attacker-supplied bytes as live DOM nodes. This can lead to full administrative takeover, allowing the attacker to read non-HttpOnly cookies and CSRF tokens, exfiltrate the admin dashboard DOM, and issue authenticated requests to admin-only endpoints.

Recommendations Update AVideo to version 29.0 or later. As a temporary workaround, disable the YPTSocket plugin or set the debugSocket flag to false to prevent the rendering of the online-users debug panel.