CVE-2026-43874: WWBN AVideo WebSocket Vulnerability Allows RCE

The National Vulnerability Database has disclosed CVE-2026-43874, a high-severity vulnerability (CVSS 7.2) affecting WWBN AVideo, an open-source video platform, in versions up to and including 29.0. This flaw stems from an incomplete server-side mitigation for a previous vulnerability, CVE-2026-40911. Specifically, a critical bypass exists in how the YPTSocket relay function msgToResourceId() processes messages.

An unauthenticated attacker can exploit this by obtaining a WebSocket token and sending a malicious message. The server’s intended sanitization logic, which strips payloads under $json['msg'], is skipped because the relay function prioritizes $msg['json']. This allows the attacker’s payload, containing autoEvalCodeOnHTML, to be delivered verbatim to any logged-in user identified by to_users_id, subsequently executing arbitrary code via eval() in the client script.

This is a direct remote code execution vector against client-side browsers of authenticated users, initiated by an unauthenticated actor. Defenders using WWBN AVideo should immediately apply the fix contained in commit 9f3006f9a89a34daa67a83c6ad35f450cb91fcce to prevent exploitation. The vulnerability is categorized under CWE-94 (Improper Control of Generation of Code (‘Code Injection’)).