CVE-2026-49279: WWBN AVideo Stored XSS Vulnerability

CVE-2026-49279 Overview

CVE-2026-49279 is a Stored Cross-Site Scripting (XSS) vulnerability in WWBN AVideo, an open source video platform. The flaw affects versions 29.0 and below through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket handler. An authenticated attacker can bypass input sanitization by placing a payload in the json key rather than the msg key. Successful exploitation executes arbitrary JavaScript in any connected user's browser session. Attackers can steal session cookies, hijack accounts, and chain the flaw with Cross-Site Request Forgery (CSRF) to perform administrative actions.

Critical Impact
Authenticated attackers can execute arbitrary JavaScript in connected user sessions, enabling account takeover, session hijacking, and admin-level CSRF chaining in the default SQLite WebSocket backend.

Affected Products

WWBN AVideo versions 29.0 and below
Deployments using the default SQLite WebSocket backend
Installations with the MessageSQLite WebSocket handler enabled

Discovery Timeline

2026-07-15 - CVE-2026-49279 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-49279

Vulnerability Analysis

The vulnerability resides in plugin/YPTSocket/MessageSQLite.php, which processes inbound WebSocket messages. The handler attempts to strip the autoEvalCodeOnHTML field from browser-originated messages before relaying them. However, sanitization is applied only to $json['msg'], while the downstream msgToResourceId() function reads from $msg['json'] with higher priority. This inconsistency creates a sanitization bypass classified under [CWE-79] Improper Neutralization of Input During Web Page Generation.

Root Cause

The root cause is incomplete recursive sanitization of nested message paths. The original code called unset($json['msg']['autoEvalCodeOnHTML']) on a single key path. Attackers submitting the payload under json['json']['autoEvalCodeOnHTML'] bypass the filter entirely. The relay function then propagates the untrusted content to connected browsers, where it renders as executable JavaScript.

Attack Vector

An authenticated attacker sends a crafted WebSocket message containing the XSS payload under the json key. The malicious content is stored and relayed to every connected session by the messaging backend. When victims render the message, the script executes in their browser context. Attackers can exfiltrate session cookies, authentication tokens, and trigger admin actions through chained CSRF requests.

php

                 $this->msgToArray($json);
                 //_log_message("onMessage:msgObj: " . json_encode($json));
                 // Strip eval-able fields from browser/guest messages.
+                // Remove from all nested paths so msgToResourceId cannot relay it via msg/json/fallback.
                 if (empty($msgObj->isCommandLineInterface) && ($msgObj->sentFrom ?? '') !== 'php') {
-                    if (is_array($json['msg'] ?? null)) {
-                        unset($json['msg']['autoEvalCodeOnHTML']);
-                    }
+                    $this->removeAutoEvalCodeOnHTMLRecursive($json);
                     if (isset($json['callback']) && !preg_match('/^[a-zA-Z_][a-zA-Z0-9_]*$/', (string)$json['callback'])) {
                         unset($json['callback']);
                     }

Source: GitHub Commit 3e0b3ce

Detection Methods for CVE-2026-49279

Indicators of Compromise

WebSocket frames containing autoEvalCodeOnHTML inside nested json objects rather than msg
Outbound requests from browser sessions to attacker-controlled domains following WebSocket message delivery
Unexpected session cookie exfiltration events originating from authenticated AVideo user sessions
Administrative actions performed shortly after user interaction with the video platform messaging interface

Detection Strategies

Inspect WebSocket traffic for <script> tags, javascript: URIs, or event handler strings within message payloads
Monitor plugin/YPTSocket/MessageSQLite.php invocations and log message payloads with nested json keys
Correlate authenticated user sessions with anomalous JavaScript execution or cookie access patterns
Review WebSocket message logs for the string autoEvalCodeOnHTML in unexpected nested paths

Monitoring Recommendations

Enable verbose logging on the AVideo WebSocket handler to capture full message structure
Deploy Content Security Policy (CSP) violation reporting to surface script execution from unauthorized sources
Alert on session token requests occurring immediately after WebSocket message delivery
Track privileged account actions originating from browser contexts with active WebSocket connections

How to Mitigate CVE-2026-49279

Immediate Actions Required

Apply the upstream patch from commit 3e0b3ce2bfa766183ff0ae227439394db57b1a23 once officially released
Restrict access to authenticated AVideo endpoints and enforce least-privilege user roles
Rotate session tokens and administrative credentials if suspicious WebSocket activity is observed
Consider disabling the SQLite WebSocket backend until the patch is deployed in production

Patch Information

WWBN has published a fix in the AVideo GitHub commit 3e0b3ce, which introduces a removeAutoEvalCodeOnHTMLRecursive() helper. The patch removes autoEvalCodeOnHTML from all nested paths, preventing msgToResourceId() from relaying the payload via msg, json, or any fallback key. Additional context is available in the GitHub Security Advisory GHSA-2fhx-q92v-5fhv. The advisory notes that the patch has yet to be officially released at the time of publication.

Workarounds

Enforce a strict Content Security Policy that blocks inline scripts and untrusted script sources
Filter WebSocket messages at a reverse proxy or Web Application Firewall (WAF) to strip autoEvalCodeOnHTML keys from all nested paths
Disable the WebSocket messaging feature in AVideo until the official patch ships
Require re-authentication for administrative actions to reduce CSRF chaining impact

bash

# Example WAF rule to drop WebSocket frames containing the vulnerable field
# (adapt to your WAF syntax)
SecRule REQUEST_BODY "@rx autoEvalCodeOnHTML" \
    "id:1004927,phase:2,deny,status:403,msg:'Block AVideo CVE-2026-49279 payload'"