CVE-2026-43874

WWBN AVideo is an open source video platform. In versions up to and including 29.0, the server-side mitigation for the YPTSocket autoEvalCodeOnHTML eval sink (from CVE-2026-40911) only strips the payload when it sits under $json['msg'], but the relay function msgToResourceId() selects the outbound message from $msg['json'] before $msg['msg']. An unauthenticated attacker can obtain a WebSocket token from plugin/YPTSocket/getWebSocket.json.php, connect to the WebSocket server, and send a message with autoEvalCodeOnHTML nested under a top-level json field — the strip branch is skipped, the relay delivers the payload verbatim to any logged-in user identified by to_users_id, and the client script runs it through eval(). Commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce contains an updated fix.

• CWE-94

• https://github.com/WWBN/AVideo/commit/9f3006f9a89a34daa67a83c6ad35f450cb91fcce
• https://github.com/WWBN/AVideo/security/advisories/GHSA-ghcv-22jf-vfxm
• https://github.com/WWBN/AVideo/security/advisories/GHSA-ghcv-22jf-vfxm

Published

May 11, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43869Improper Validation of Certificate with Host Mismatch vulner…7.3
• CVE-2026-4387StrongDM Desktop Application before 23.74.0 (Desktop Client …2
• CVE-2026-43870Origin Validation Error, Improper Limitation of a Pathname t…7.3
• CVE-2026-43871Loop with Unreachable Exit Condition ('Infinite Loop') vulne…7.5
• CVE-2026-43872Actual is an open-source personal finance application. Prior…5.3
• CVE-2026-43873WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-43875WWBN AVideo is an open source video platform. In versions up…6.8
• CVE-2026-43876WWBN AVideo is an open source video platform. In versions up…6.4
• CVE-2026-43877WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-43878WWBN AVideo is an open source video platform. In versions up…6.1
• CVE-2026-43879WWBN AVideo is an open source video platform. In versions up…5.4
• CVE-2026-4388The Form Maker by 10Web plugin for WordPress is vulnerable t…7.2