Critical RCE in AVideo YPTSocket Plugin: Unauthenticated Account Takeover
The National Vulnerability Database has disclosed CVE-2026-40911, a critical remote code execution vulnerability in WWBN AVideo, an open-source video platform. Affecting versions 29.0 and prior, this flaw stems from improper sanitization within the YPTSocket plugin’s WebSocket server. Specifically, attacker-supplied JSON message bodies containing unsanitized msg or callback fields are relayed to all connected clients.
Client-side JavaScript, located in plugin/YPTSocket/script.js, directly feeds these relayed fields into eval() sinks. This creates a severe client-side arbitrary JavaScript execution vulnerability. Since AVideo issues anonymous tokens that are never revalidated, an unauthenticated attacker can broadcast malicious JavaScript. This code executes within the origin of every currently connected user, including administrators.
The implications are catastrophic: universal account takeover, session theft, and arbitrary privileged action execution. The CVSS score is a perfect 10.0, highlighting the ease of exploitation and the devastating impact. A fix is available in commit c08694bf6264eb4decceb78c711baee2609b4efd. Organizations running AVideo must patch immediately.
What This Means For You
- If your organization uses WWBN AVideo, you need to verify your version immediately. This isn't a theoretical flaw; it's an unauthenticated RCE leading to full account takeover. Patch to commit `c08694bf6264eb4decceb78c711baee2609b4efd` or later without delay. Assume compromise if you were running affected versions and audit all administrator and user sessions for suspicious activity.
Related ATT&CK Techniques
🛡️ Detection Rules
3 rules · 6 SIEM formats3 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
AVideo YPTSocket Plugin Unauthenticated RCE via eval() - CVE-2026-40911
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-40911 | Vulnerability | CVE-2026-40911 |
| CVE-2026-40911 | Affected Product | versions 29.0 and |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | April 22, 2026 at 00:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related Posts
HKUDS OpenHarness Default Config Exposes Systems (CVE-2026-6823)
CVE-2026-6823 — HKUDS OpenHarness prior to PR #147 remediation contains an insecure default configuration vulnerability where remote channels inherit allow_from = ["*"] permitting arbitrary remote...
Critical AVideo XSS Vulnerability Exposes Admin Settings
CVE-2026-40925 — WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site...
CRITICAL SQLi in ElectricSQL: Full Database Compromise
CVE-2026-40906 — Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based...