CVE-2026-86188
Received Received - Intake

AVideo YPTSocket Plugin XSS via Websocket Callback

Publication date: 2026-09-05

Last updated on: 2026-09-05

Assigner: VulnCheck

Description
AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-05
Last Modified
2026-09-05
Generated
2026-09-05
AI Q&A
2026-09-05
EPSS Evaluated
N/A
NVD
CVE-2026-86188
EUVD
EUVD-2026-72009

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 29.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in AVideo with the YPTSocket plugin enabled. It allows unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via crafted websocket messages. The attack exploits a flaw where the websocket layer permits unauthenticated peers to select global JavaScript functions that accept untrusted data and assign it to innerHTML, enabling script execution without user interaction.

Detection Guidance

Check if the YPTSocket plugin is enabled in your AVideo installation by inspecting the plugin directory or database. Look for websocket callback functions that allow unauthenticated access or global functions like avideoConfirmHTML that assign untrusted data to innerHTML. Review server logs for unusual websocket traffic or callback requests from unauthenticated sources.

Impact Analysis

If exploited, this vulnerability can lead to session hijacking, account takeover, or full site compromise. Attackers can target specific users or all anonymous viewers simultaneously. For administrators, this could result in complete site takeover. Other users may face mass session compromise or data theft.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and privacy, such as GDPR and HIPAA, due to potential unauthorized access to sensitive user data, lack of proper authentication, and failure to protect user sessions. Exploitation could lead to data breaches, triggering mandatory breach notifications and penalties.

Mitigation Strategies

Disable the YPTSocket plugin immediately if enabled. Update AVideo to the latest version that patches this vulnerability. Implement strict allowlisting for websocket callback functions and restrict token issuance to authenticated users only. Monitor network traffic for suspicious websocket activity targeting global functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86188. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart