# CVE-2026-54458: AVideo: Unauthenticated Stored DOM Cross-Site Scripting via Per-Client Metadata Broadcast in YPTSocket Plugin > Unauthenticated attackers can execute arbitrary JavaScript in admin sessions via the YPTSocket plugin, leading to full administrative takeover. - **Severity:** Critical 9.6 (`CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L`) - **Exploited in the wild:** Not known - **Login needed:** Not needed - **Attackable:** Over the internet - **Victim action needed:** A user has to click or open something - **Fix available:** Yes - **Published:** 15 Jul 2026 - **Updated:** 16 Jul 2026 - **Also known as:** GHSA-8whc-2wmv-ww35 ## What is CVE-2026-54458? CVE-2026-54458 is a critical cross-site scripting vulnerability in WWBN AVideo, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. ### Official description WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16. Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation) ## Which versions are affected by CVE-2026-54458? 2 open source packages ship an affected version, including WWBN/AVideo. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `WWBN/AVideo` | Packagist | All versions | 29.1.0 | | `WWBN/AVideo` | Packagist | All versions | 29.1.0 | ## How do I fix CVE-2026-54458? Upgrade WWBN/AVideo to 29.1.0 or later. ## Is CVE-2026-54458 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54458 exists. ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-54458 and fix it if it is affected. What it is: CVE-2026-54458 is a critical cross-site scripting vulnerability in WWBN AVideo, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-54458 exists. Affected packages and fixed versions: - WWBN/AVideo (Packagist): affected all versions; fixed in 29.1.0 - WWBN/AVideo (Packagist): affected all versions; fixed in 29.1.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-54458/ (Markdown: https://insights.sbomify.com/CVE-2026-54458/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-54458 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-54458 - OSV: https://osv.dev/vulnerability/CVE-2026-54458 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-54458/ Summaries are generated and may contain mistakes; the official description above is the record.