CVE-2026-50183 WWBN AVideo: Stored XSS via Hostile YouTube Video Title in AVideo YouTubeAPI Gallery Section
Attackers can inject malicious scripts via YouTube video titles, leading to administrative account takeover in AVideo.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-50183?
CVE-2026-50183 is a medium-severity cross-site scripting vulnerability in WWBN AVideo, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup with no HTML encoding. The title is set by the YouTube video uploader (anyone in the world) and is treated by AVideo as trusted content. A YouTube uploader who controls a video matching the operator's configured query injects HTML into the AVideo homepage by setting their video's title to a JavaScript-bearing string; the payload then executes in the browser of every visitor who loads any page that renders the gallery. When the visitor is an AVideo administrator, the injected JavaScript performs any admin action (create user, promote to admin, change configuration, install plugin) that uses cookie-based authentication without an additional CSRF token, escalating the bug into full administrative takeover. The payload persists for the duration of cacheTimeout (default 3600 seconds) after the malicious title is set on YouTube and survives YouTube removing the hostile video for the same window. This issue has been addressed by commit https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877.
Weakness: CWE-79
Which versions are affected by CVE-2026-50183?
2 open source packages ship an affected version, including WWBN/AVideo.
| Package | Affected | Fixed in |
|---|---|---|
WWBN/AVideo Packagist | All versions to 29.0 | None |
WWBN/AVideo Packagist | All versions to 29.0 | None |
How do I fix CVE-2026-50183?
No fix has been published for CVE-2026-50183 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-50183 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-50183 exists.
Sources
Also known as GHSA-66q5-cj5g-wrfx.