CVE-2026-54458

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including <img> with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16.

• CWE-79

• https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35

Published

Jul 15, 2026

Last Modified

Jul 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-5444A heap buffer overflow vulnerability exists in the PAM image…7.1
• CVE-2026-54443Dashy is a self-hostable personal dashboard. From 1.9.4 unti…5.9
• CVE-2026-54444Rejected reason: ]** REJECT ** DO NOT USE THIS CANDIDATE NUM…
• CVE-2026-54445vantage6 is an open-source infrastructure for privacy preser…6.9
• CVE-2026-54448Trivy is a security scanner. Prior to 0.71.0, when Trivy sca…6.5
• CVE-2026-5445An out-of-bounds read vulnerability exists in the `DecodeLoo…9.1
• CVE-2026-5446In wolfSSL, ARIA-GCM cipher suites used in TLS 1.2 and DTLS …7.1
• CVE-2026-54463websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54464### Impact If this library is used in tandem with the `perm…6.3
• CVE-2026-54465websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54466websocket-driver is a WebSocket protocol handler with plugga…7.5
• CVE-2026-54468Dell Unisphere for PowerMax, version(s) 10.3.0.5 and prior, …6.5