CVE-2026-40911

Katalog CVE

CVSS 10.0 · Critical EPSS 0,86%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada wwbn avideo. Skor CVSS 3.1 10.0 (Critical) menurut github.com.

Deskripsi (NVD)

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

10.0 (Critical), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

0,86% peluang dieksploitasi; lebih tinggi dari 57,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/security/advisories/GHSA-gph2-j4c9-vhhr exploit · advisory vendor
• https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd patch