CVE-2026-54458: WWBN AVideo YPTSocket XSS Vulnerability

CVE-2026-54458 Overview

CVE-2026-54458 is a stored DOM-based Cross-Site Scripting (XSS) vulnerability in the WWBN AVideo open source video platform. The flaw exists in the YPTSocket plugin in versions prior to 29.0. An unauthenticated remote attacker can inject arbitrary JavaScript that executes in the browser of any administrator viewing the YPTSocket online-users debug panel. Successful exploitation grants the attacker full administrative session control, including access to non-HttpOnly cookies, the rendered CSRF token, and any admin-only endpoint. The vulnerability is tracked under [CWE-79] and was patched in commit 8be71e53ccbe9b84b30870db386fb4d2b11e1c16.

Critical Impact
A single anonymous WebSocket connection can be escalated to full administrative takeover of the AVideo instance through the administrator's own authenticated session.

Affected Products

WWBN AVideo versions prior to 29.0
YPTSocket plugin component
AVideo administrative dashboard rendering the online-users debug panel

Discovery Timeline

2026-07-15 - CVE-2026-54458 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-54458

Vulnerability Analysis

The vulnerability chains an authentication weakness with unsanitized data flow into a client-side sink. The endpoint plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller. This allows an unauthenticated attacker to open a valid WebSocket session against the server.

Inside plugin/YPTSocket/MessageSQLiteV2.php, the MessageSQLiteV2::onOpen handler reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL. Neither value is validated or encoded. Both values are stored in the in-memory SQLite connections table and broadcast inside the users_id_online array to every connected client.

On the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal and passes it to jQuery $.append(html). jQuery parses the attacker-supplied bytes into live DOM nodes, including <img> elements with inline event handlers that fire immediately.

Root Cause

The root cause is missing input validation on WebSocket query parameters combined with unsafe HTML sink usage on the client. Server code trusts anonymous WebSocket inputs, and the JavaScript renderer uses $.append with an unescaped template literal rather than a text-only assignment.

Attack Vector

An attacker obtains a signed WebSocket token from the anonymous endpoint, then opens a WebSocket to the server with malicious page_title and webSocketSelfURI values. When an administrator loads the YPTSocket online-users panel, the injected payload executes in the admin origin. The attacker can then read the CSRF token, issue authenticated admin requests, and chain into any admin-context mutation.

php

// Patch excerpt: plugin/YPTSocket/MessageSQLiteV2.php
         $client['yptDeviceId'] = $json->yptDeviceId;
         $client['client'] = deviceIdToObject($json->yptDeviceId);
         if (!empty($wsocketGetVars['webSocketSelfURI'])) {
-            $client['selfURI'] = $wsocketGetVars['webSocketSelfURI'];
+            $rawURI = $wsocketGetVars['webSocketSelfURI'];
+            // Only accept http/https URIs to prevent javascript: href injection
+            if (filter_var($rawURI, FILTER_VALIDATE_URL) && preg_match('/^https?:\/\//i', $rawURI)) {
+                $client['selfURI'] = $rawURI;
+            } else {
+                $client['selfURI'] = $json->selfURI;
+            }
         } else {
             $client['selfURI'] = $json->selfURI;
         }
         $client['isCommandLine'] = @$wsocketGetVars['isCommandLine'];
-        $client['page_title'] = @utf8_encode(@$wsocketGetVars['page_title']);
+        $client['page_title'] = htmlspecialchars((string)@$wsocketGetVars['page_title'], ENT_QUOTES | ENT_HTML5, 'UTF-8');
         $client['ip'] = $json->ip;

Source: GitHub Commit 8be71e5. The patch validates webSocketSelfURI against an http/https URL pattern and applies htmlspecialchars to page_title before storage.

Detection Methods for CVE-2026-54458

Indicators of Compromise

Anonymous HTTP requests to plugin/YPTSocket/getWebSocket.json.php from external IPs followed by WebSocket upgrades to the YPTSocket endpoint.
WebSocket connection URLs containing HTML tag characters, on*= handlers, or javascript: schemes in the page_title or webSocketSelfURI parameters.
Unexpected outbound requests from administrator browsers to attacker-controlled hosts immediately after loading the admin dashboard.
Admin API calls originating from admin sessions but preceded by no legitimate user UI interaction.

Detection Strategies

Inspect web server and reverse proxy logs for WebSocket handshake URLs containing suspicious characters such as <, >, ", or onerror=.
Correlate anonymous getWebSocket.json.php token issuance with subsequent WebSocket upgrades that carry non-ASCII or script-like query parameters.
Monitor for outbound HTTP requests carrying session cookies or CSRF tokens as query parameters, which indicates data exfiltration from the admin DOM.

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting on the AVideo admin dashboard and forward report-uri events to central logging.
Alert on any modification to administrator accounts, plugin configuration, or upload endpoints not preceded by a legitimate admin login flow.
Ingest AVideo access and application logs into a SIEM or data lake such as Singularity Data Lake to correlate WebSocket activity with admin-context API calls.

How to Mitigate CVE-2026-54458

Immediate Actions Required

Upgrade WWBN AVideo to version 29.0 or later, which contains commit 8be71e53ccbe9b84b30870db386fb4d2b11e1c16.
Restrict network access to the AVideo admin interface and WebSocket endpoint to trusted management networks until patching is complete.
Invalidate all administrator sessions and rotate CSRF tokens after upgrading to remove any active attacker-held sessions.
Review admin audit logs for unauthorized configuration changes, new admin accounts, or plugin modifications.

Patch Information

The fix is available in WWBN AVideo commit 8be71e5. Server-side, page_title is sanitized with htmlspecialchars using ENT_QUOTES | ENT_HTML5, and webSocketSelfURI is validated as an http/https URL. See the GitHub Security Advisory GHSA-8whc-2wmv-ww35 for full details.

Workarounds

Disable the YPTSocket plugin until the patched version is deployed.
Block unauthenticated access to plugin/YPTSocket/getWebSocket.json.php at the reverse proxy or WAF layer.
Deploy a strict Content Security Policy on the admin dashboard that disallows inline event handlers and unsafe evaluation.
Add WAF rules that reject WebSocket handshake requests where query parameters contain HTML metacharacters or script schemes.

bash

# Example nginx rule to block suspicious YPTSocket query parameters
location ~ ^/plugin/YPTSocket/ {
    if ($args ~* "(<|>|onerror=|onload=|javascript:|%3C|%3E)") {
        return 403;
    }
    proxy_pass http://avideo_backend;
}