CVE-2026-86188: AVideo YPTSocket Plugin XSS Vulnerability

CVE-2026-86188 Overview

CVE-2026-86188 is a cross-site scripting (XSS) vulnerability in AVideo when the YPTSocket plugin is enabled. Unauthenticated attackers can execute arbitrary JavaScript in other users' browsers by sending crafted WebSocket messages. The vulnerability abuses the websocket callback mechanism, which resolves callback names to global JavaScript functions such as avideoConfirmHTML and passes attacker-controlled data into innerHTML. Exploitation requires no authentication and no user interaction. The issue is tracked as [CWE-79] Improper Neutralization of Input During Web Page Generation.

Critical Impact
Unauthenticated remote attackers can execute arbitrary JavaScript in the browsers of active AVideo users, enabling session theft, credential capture, and account takeover through the victim's origin.

Affected Products

AVideo platform installations with the YPTSocket plugin enabled
Deployments exposing the AVideo WebSocket endpoint to untrusted networks
Any user session connected to a vulnerable AVideo instance

Discovery Timeline

2026-09-05 - CVE-2026-86188 published to the National Vulnerability Database
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-86188

Vulnerability Analysis

The vulnerability resides in the client-side handling of WebSocket messages delivered by the YPTSocket plugin. The client resolves a callback field within received socket messages to a global JavaScript function and invokes it with the message payload. When the resolved callback is a sink such as avideoConfirmHTML, the payload is written into the Document Object Model (DOM) using the innerHTML property. Because the attacker controls both the callback name and the payload, arbitrary HTML and script content executes in the origin of the victim's session.

The attack does not require prior authentication. An unauthenticated actor with network reach to the WebSocket endpoint can broadcast or target crafted socket messages to connected clients. Successful execution grants the attacker read and write access to the victim's session context, including cookies not marked HttpOnly, local storage, and any authenticated API surface exposed to the browser.

Root Cause

The root cause is missing output encoding at a DOM sink. The avideoConfirmHTML handler and similar callbacks assign untrusted socket payloads to innerHTML without sanitization. Combined with a callback resolution mechanism that dispatches by string name against the global scope, this creates an unauthenticated reflected-style DOM XSS reachable through the WebSocket channel.

Attack Vector

Exploitation follows a network-based path over the AVideo WebSocket transport. The attacker connects to the socket endpoint exposed by the YPTSocket plugin and emits messages whose callback field names a DOM-writing global function and whose payload contains HTML with an executable script vector. Connected AVideo browser clients receive the message, dispatch to the named callback, and render the malicious markup. Refer to the GitHub Security Advisory and the VulnCheck XSS Advisory for the technical breakdown.

Detection Methods for CVE-2026-86188

Indicators of Compromise

Inbound WebSocket frames to the AVideo YPTSocket endpoint containing callback values that match DOM-writing functions such as avideoConfirmHTML.
Socket message payloads containing HTML tags, <script> fragments, onerror=, onload=, or javascript: URIs.
Unexpected outbound requests from AVideo user browsers to attacker-controlled domains shortly after socket message delivery.

Detection Strategies

Inspect WebSocket traffic to the AVideo endpoint and alert on messages whose callback field references sensitive client-side functions or whose payload contains HTML control characters.
Deploy Content Security Policy (CSP) reporting to capture inline script and unsafe DOM writes originating from AVideo pages.
Correlate anomalous session activity, such as password changes or privilege elevations, with recent WebSocket activity on the same account.

Monitoring Recommendations

Enable verbose logging on the AVideo application tier and any reverse proxy fronting the WebSocket endpoint.
Monitor for spikes in connections to the YPTSocket endpoint from single source addresses or non-browser user agents.
Track browser console errors and CSP violation reports from AVideo hostnames for indicators of injection attempts.

How to Mitigate CVE-2026-86188

Immediate Actions Required

Disable the YPTSocket plugin on AVideo installations until a fixed release is deployed.
Restrict network access to the AVideo WebSocket endpoint to trusted origins and authenticated sessions.
Rotate session tokens and administrative credentials for AVideo accounts that were active during exposure.

Patch Information

Refer to the GitHub Security Advisory GHSA-xpx7-h2x7-59qq for the vendor's fix guidance and affected version details. Upgrade AVideo to the release identified by the advisory as containing the patched WebSocket callback handling and DOM sink sanitization.

Workarounds

Disable or unload the YPTSocket plugin in the AVideo administration panel.
Enforce a strict Content Security Policy that blocks inline scripts and restricts script sources on AVideo pages.
Place the WebSocket endpoint behind an authenticated reverse proxy and drop socket frames containing HTML control characters in the payload.

bash

# Configuration example: block WebSocket frames containing HTML injection markers
# Example NGINX rule fragment for a reverse proxy fronting AVideo
location /socket.io/ {
    if ($request_body ~* "(<script|onerror=|onload=|javascript:)") {
        return 403;
    }
    proxy_pass http://avideo_backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
}