CVE-2026-50183: WWBN AVideo Stored XSS Vulnerability

CVE-2026-50183 Overview

CVE-2026-50183 is a stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the WWBN AVideo open source video platform. Versions 29.0 and below are affected. The YouTubeAPI plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup without HTML encoding. Any YouTube uploader whose video matches the operator's configured query can inject HTML into the AVideo homepage by setting the video title to a JavaScript-bearing string. The payload executes in the browser of every visitor rendering the gallery.

Critical Impact
When an AVideo administrator visits an affected page, the injected script performs admin actions using cookie-based authentication, enabling full administrative takeover of the platform.

Affected Products

WWBN AVideo versions 29.0 and below
AVideo YouTubeAPI plugin (plugin/YouTubeAPI/gallerySection.php)
AVideo instances with a homepage gallery that renders YouTube results

Discovery Timeline

2026-07-15 - CVE-2026-50183 published to the National Vulnerability Database (NVD)
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-50183

Vulnerability Analysis

The YouTubeAPI plugin fetches video metadata from the YouTube Data API and renders results into the AVideo homepage gallery. The plugin trusts the snippet.title and snippet.thumbnails fields returned by YouTube as safe HTML. The gallery template in plugin/YouTubeAPI/gallerySection.php echoes these values directly into title, alt, and src attributes without encoding. A YouTube uploader anywhere in the world can craft a title containing HTML control characters or attribute-breaking payloads. When the AVideo operator's configured query matches that video, the payload is embedded verbatim in the rendered page.

Root Cause

The root cause is missing output encoding on data supplied by an external, untrusted source. AVideo treats the YouTube API response as trusted server-side content, but the title field is controlled by arbitrary third-party uploaders. The absence of htmlspecialchars() on $video->title and $video->thumbnails before echoing them into HTML attributes allows attribute-context injection and script execution.

Attack Vector

An attacker uploads a YouTube video whose title matches the operator's configured YouTubeAPI query and embeds JavaScript within the title. When any visitor loads a page rendering the gallery, the payload executes. If the visitor is an administrator, the script issues authenticated requests using session cookies to create users, promote to admin, change configuration, or install plugins, because these actions lack an additional CSRF token. The payload persists for the duration of cacheTimeout (default 3600 seconds) and survives removal of the hostile video from YouTube for that cache window.

php

         <?php
         foreach ($object->videos as $video) {
             $youtubeEmbedLink = "{$global['webSiteRootURL']}evideo/".  encryptString(json_encode($video));
-            $youtubeTitle = $video->title;
-            $youtubeThumbs = $video->thumbnails;
+            $youtubeTitle = htmlspecialchars($video->title, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+            $youtubeThumbs = htmlspecialchars($video->thumbnails, ENT_QUOTES | ENT_HTML5, 'UTF-8');
             ?>
             <div class="col-lg-...">
                 <a class="evideo" href="<?php echo $youtubeEmbedLink; ?>" title="<?php echo $youtubeTitle; ?>">
                     <div class="aspectRatio16_9">
-                        <img src="<?php echo $youtubeThumbs; ?>" alt="<?php echo str_replace('"', '', $youtubeTitle); ?>" class="thumbsJPG img img-responsive" />
+                        <img src="<?php echo $youtubeThumbs; ?>" alt="<?php echo $youtubeTitle; ?>" class="thumbsJPG img img-responsive" />
                     </div>
                 </a>

Source: GitHub Commit 7292129

Detection Methods for CVE-2026-50183

Indicators of Compromise

Unexpected <script> tags, event handler attributes (onerror, onload), or quote-breaking sequences within rendered gallery HTML on the AVideo homepage.
New administrator accounts, unexpected role changes, or newly installed plugins in the AVideo admin audit log.
Outbound requests from administrator browsers to attacker-controlled domains shortly after visiting the AVideo homepage.
Cached YouTube API responses containing suspicious HTML characters in the snippet.title field.

Detection Strategies

Inspect the rendered HTML of gallery pages for content that did not originate from AVideo templates, focusing on attribute-context breakouts in title= and alt= values.
Review the AVideo Users, Configurations, and Plugins tables for changes correlated with administrator session activity.
Correlate web server access logs with admin API endpoint calls that occurred without direct admin UI navigation.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting to capture inline script executions in the gallery context.
Alert on administrative privilege changes, plugin installations, and configuration writes issued from browser sessions rather than CLI.
Monitor the YouTubeAPI plugin cache directory for entries containing HTML metacharacters in title fields.

How to Mitigate CVE-2026-50183

Immediate Actions Required

Upgrade WWBN AVideo to the version containing commit 7292129eaee5f609beae103b5cb387d55f17b877, which applies htmlspecialchars() to YouTube-supplied fields.
Disable the YouTubeAPI plugin until the patch is applied if upgrade is not immediately feasible.
Clear the YouTubeAPI plugin cache to remove any poisoned entries that persist for cacheTimeout seconds.
Audit administrator accounts, roles, installed plugins, and configuration changes for unauthorized modifications.

Patch Information

The fix is applied in plugin/YouTubeAPI/gallerySection.php and encodes $video->title and $video->thumbnails with htmlspecialchars($value, ENT_QUOTES | ENT_HTML5, 'UTF-8') before rendering. See the GitHub Security Advisory GHSA-66q5-cj5g-wrfx and the upstream patch commit.

Workarounds

Disable the YouTubeAPI plugin from the AVideo admin console until patching completes.
Restrict the plugin's configured search query to trusted channel IDs so untrusted uploaders cannot match the gallery query.
Deploy a strict Content Security Policy that disallows inline script execution on gallery pages.
Require administrators to use a separate browser profile that does not carry AVideo session cookies when browsing public pages.

bash

# Temporary workaround: clear cached YouTube API responses and disable the plugin
rm -rf /var/www/AVideo/videos/cache/YouTubeAPI/*
# Then, in the AVideo admin UI: Plugins -> YouTubeAPI -> Disable