CVE-2026-40911
Published: 21 April 2026
Summary
CVE-2026-40911 is a critical-severity Code Injection (CWE-94) vulnerability in Wwbn Avideo. Its CVSS base score is 10.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-18 (Mobile Code) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires validation and sanitization of attacker-supplied JSON `msg` and `callback` fields on the WebSocket server before relaying to prevent code injection.
Mandates filtering of relayed JSON messages to clients to block malicious content from reaching the client-side `eval()` sinks.
Restricts execution of arbitrary JavaScript mobile code delivered via unsanitized WebSocket broadcasts to connected clients.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows unauthenticated exploitation of a public-facing WebSocket server (T1190) to inject and execute arbitrary JavaScript in connected clients' browsers via eval sinks (T1059.007), enabling account takeover and session theft.
NVD Description
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains…
more
two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix.
Deeper analysisAI
CVE-2026-40911 is a critical code injection vulnerability (CWE-94) affecting WWBN AVideo, an open source video platform, in versions 29.0 and prior. The issue resides in the YPTSocket plugin's WebSocket server, which relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, the file `plugin/YPTSocket/script.js` contains two `eval()` sinks directly processing these fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95), enabling arbitrary JavaScript execution within the origin of connected users.
An unauthenticated attacker can exploit this vulnerability due to tokens being minted for anonymous visitors without revalidation beyond decryption. By connecting to the WebSocket server and sending a crafted JSON message, the attacker broadcasts malicious JavaScript that executes immediately in the browsers of all currently connected clients, including administrators. This results in universal account takeover, session theft, and execution of privileged actions across all victims.
Mitigation is provided in commit c08694bf6264eb4decceb78c711baee2609b4efd, which addresses the unsanitized relaying and eval sinks. The GitHub Security Advisory GHSA-gph2-j4c9-vhhr details the issue and recommends updating to the patched version.
Details
- CWE(s)