AVideo (<= C3edcc274c389816d434acadac07ee78eaf330c1) - CraftedSignal Threat Feed

Cross-Site Scripting Vulnerability in AVideo YPTSocket Plugin

hello@craftedsignal.io — Sat, 05 Sep 2026 13:32:19 +0000

AVideo, an open-source video platform, contains a critical cross-site scripting (XSS) vulnerability (CVE-2026-86188) within its YPTSocket plugin. The vulnerability stems from insecure handling of websocket callback messages. An unauthenticated attacker can send a crafted socket message to the platform, specifying a callback name that triggers existing global functions, such as 'avideoConfirmHTML'. These functions improperly process untrusted data by assigning it directly to the innerHTML property of an element within the Document Object Model (DOM).

Because this process occurs via the websocket interface, an attacker can trigger this execution in the browser of any user connected to the AVideo instance without requiring authentication or user interaction. Successful exploitation leads to arbitrary script execution within the victim's origin, potentially allowing session hijacking, unauthorized actions, or further compromise of the user's session. Defenders should prioritize updating or disabling the YPTSocket plugin until a vendor-supplied patch is applied.

Impact

The vulnerability allows unauthenticated attackers to achieve arbitrary JavaScript execution in the context of any user's browser session. This can lead to full compromise of the user's session on the AVideo platform, including the ability to perform actions on behalf of the user, exfiltrate sensitive data, or redirect the user to malicious sites. The scope of impact includes any deployment of AVideo where the YPTSocket plugin is active and reachable by an attacker.

Recommendation

Identify and audit all AVideo instances to determine if the YPTSocket plugin is enabled.
Disable the YPTSocket plugin if it is not business-critical to prevent exploitation of CVE-2026-86188.
Monitor webserver access logs for anomalous websocket connection attempts or unexpected patterns in request parameters targeting the YPTSocket API.
Patch AVideo to the latest version provided by the vendor once an update addressing CVE-2026-86188 is available.

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Encoding

hello@craftedsignal.io — Sun, 30 Aug 2026 17:11:37 +0000

WWBN AVideo contains a server-side request forgery (SSRF) vulnerability identified as CVE-2026-82648, located within the isSSRFSafeURL function. The vulnerability stems from a failure to correctly normalize NAT64 addresses when they are presented in a hexadecimal format. Because the function does not account for these specific representations, attackers can bypass existing URL filtering protections. By crafting malicious requests containing NAT64 addresses such as 64:ff9b::a9fe:a9fe, an unauthorized actor can force the application to perform requests against restricted internal resources, including cloud metadata services (e.g., 169.254.169.254) and local loopback interfaces. This flaw is particularly significant in cloud-hosted environments where metadata services store sensitive IAM credentials or instance configuration details. Successful exploitation allows an attacker to interact with internal network segments that are otherwise protected from external reach, potentially resulting in credential theft or further lateral movement within the hosting infrastructure.

Impact

Successful exploitation allows unauthenticated attackers to bypass SSRF protections, enabling unauthorized interaction with internal cloud metadata services and local network resources. This can result in the exfiltration of instance-level credentials, sensitive configuration data, or internal system exploitation, compromising the confidentiality and integrity of the AVideo server instance.

Recommendation

Audit web application logs for HTTP requests containing unusual IPv6 NAT64 or hex-encoded address strings directed at internal hostnames or IP ranges.
Implement a secondary validation layer at the network edge or application-level proxy to verify that requests originating from AVideo are not destined for reserved or private IP ranges, regardless of the encoding used in the URL.
Monitor for unauthorized access attempts to local cloud metadata services from the AVideo application host.
Review all AVideo instance configurations to ensure they are updated to the latest vendor-provided patches that resolve CVE-2026-82648.

Authentication Bypass in AVideo via Parameter Manipulation

hello@craftedsignal.io — Sat, 22 Aug 2026 15:30:44 +0000

AVideo through commit 9c39d8c8 contains a critical authentication bypass vulnerability due to flawed validation logic within the deduplicateByEncoderQueueId() and useVideoHashOrLogin() functions. The software fails to perform proper ownership verification when the videos_id parameter is omitted during an upload process, causing the system to return a video_id_hash belonging to any video, including those owned by administrators. Because the useVideoHashOrLogin() function treats this hash as a valid credential for passwordless login, an attacker can leverage a captured hash to authenticate as the video owner. This flaw allows an attacker with low-privileged upload access to escalate privileges to the administrator level, enabling full system configuration control. This vulnerability highlights the risks of implicit trust in video identifier hashes for session management.

Impact

Successful exploitation allows for full administrative account takeover within an AVideo instance. Attackers can modify system configurations, manage user accounts, and potentially gain access to sensitive media content. This is particularly critical for enterprise or public-facing video platforms where AVideo is used to manage high-privileged administrative accounts.

Recommendation

Apply patches or upgrade AVideo instances to a version beyond commit 9c39d8c8 to address the logic error in ownership verification.
Monitor web server logs for anomalous POST or GET requests to upload endpoints where the videos_id parameter is absent or manipulated.
Audit current AVideo session management logs for unusual passwordless login patterns involving video_id_hash parameters.