CVE-2026-40911: CWE-94: Improper Control of Generation of Code ('Code Injection') in WWBN AVideo
CVE-2026-40911 is a critical code injection vulnerability in WWBN AVideo versions 29. 0 and earlier. The YPTSocket plugin's WebSocket server relays attacker-controlled JSON message fields without sanitization, which are then passed to eval() calls on connected clients. This allows an unauthenticated attacker to execute arbitrary JavaScript in the context of all connected users, including administrators. The vulnerability enables universal account takeover, session theft, and execution of privileged actions. A fix is available in commit c08694bf6264eb4decceb78c711baee2609b4efd.
AI Analysis
Technical Summary
WWBN AVideo (<=29.0) contains a code injection vulnerability (CWE-94) in the YPTSocket plugin's WebSocket server. It forwards attacker-supplied JSON message bodies, specifically the 'msg' and 'callback' fields, to all connected clients without sanitization. On the client side, these fields are passed directly to eval() calls in 'plugin/YPTSocket/script.js' (lines 568 and 95). Because tokens for anonymous visitors are minted and not revalidated beyond decryption, unauthenticated attackers can broadcast arbitrary JavaScript to all connected users. This leads to universal account takeover, session theft, and privileged action execution. The vulnerability has a CVSS 3.1 base score of 10.0 (critical). A fix is committed in c08694bf6264eb4decceb78c711baee2609b4efd.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code in the browser context of every connected user, including administrators. This results in universal account takeover, session theft, and execution of privileged actions within the affected AVideo platform instances. The vulnerability fully compromises confidentiality, integrity, and availability (CVSS impact metrics: C:H/I:H/A:H).
Mitigation Recommendations
A fix for this vulnerability is available in commit c08694bf6264eb4decceb78c711baee2609b4efd. Users of WWBN AVideo should update to a version that includes this fix. Since the vendor advisory or patch links are not explicitly provided, confirm the application of this commit or an official patch from WWBN before deployment. Until patched, restrict access to the WebSocket service and consider disabling the YPTSocket plugin if feasible.
CVE-2026-40911: CWE-94: Improper Control of Generation of Code ('Code Injection') in WWBN AVideo
Description
CVE-2026-40911 is a critical code injection vulnerability in WWBN AVideo versions 29. 0 and earlier. The YPTSocket plugin's WebSocket server relays attacker-controlled JSON message fields without sanitization, which are then passed to eval() calls on connected clients. This allows an unauthenticated attacker to execute arbitrary JavaScript in the context of all connected users, including administrators. The vulnerability enables universal account takeover, session theft, and execution of privileged actions. A fix is available in commit c08694bf6264eb4decceb78c711baee2609b4efd.
CVSS v3.1
Score 10.0critical
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
WWBN AVideo (<=29.0) contains a code injection vulnerability (CWE-94) in the YPTSocket plugin's WebSocket server. It forwards attacker-supplied JSON message bodies, specifically the 'msg' and 'callback' fields, to all connected clients without sanitization. On the client side, these fields are passed directly to eval() calls in 'plugin/YPTSocket/script.js' (lines 568 and 95). Because tokens for anonymous visitors are minted and not revalidated beyond decryption, unauthenticated attackers can broadcast arbitrary JavaScript to all connected users. This leads to universal account takeover, session theft, and privileged action execution. The vulnerability has a CVSS 3.1 base score of 10.0 (critical). A fix is committed in c08694bf6264eb4decceb78c711baee2609b4efd.
Potential Impact
Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript code in the browser context of every connected user, including administrators. This results in universal account takeover, session theft, and execution of privileged actions within the affected AVideo platform instances. The vulnerability fully compromises confidentiality, integrity, and availability (CVSS impact metrics: C:H/I:H/A:H).
Mitigation Recommendations
A fix for this vulnerability is available in commit c08694bf6264eb4decceb78c711baee2609b4efd. Users of WWBN AVideo should update to a version that includes this fix. Since the vendor advisory or patch links are not explicitly provided, confirm the application of this commit or an official patch from WWBN before deployment. Until patched, restrict access to the WebSocket service and consider disabling the YPTSocket plugin if feasible.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-15T16:37:22.768Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69e85dc119fe3cd2cd7080ae
Added to database: 4/22/2026, 5:33:53 AM
Last enriched: 4/29/2026, 11:42:38 AM
Last updated: 6/6/2026, 11:15:41 AM
Views: 81
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.