WWBN AVideo (<=29.0) contains a critical CWE-94 code injection vulnerability in the YPTSocket plugin. The WebSocket server forwards attacker-supplied JSON message bodies to all connected clients without sanitizing the 'msg' or 'callback' fields. On the client side, these fields are passed directly to eval() calls in plugin/YPTSocket/script.js, enabling execution of arbitrary JavaScript. Because tokens for anonymous visitors are minted and not revalidated beyond decryption, unauthenticated attackers can broadcast malicious scripts to all connected users, including administrators. This can result in universal account takeover, session theft, and privileged action execution. The vulnerability is tracked as CVE-2026-40911 with a CVSS 3.1 score of 10.0 (critical). A code fix is committed in c08694bf6264eb4decceb78c711baee2609b4efd.

An unauthenticated attacker can execute arbitrary JavaScript in the browser context of every connected user, including administrators. This can lead to universal account takeover, session theft, and execution of privileged actions within the AVideo platform. The vulnerability has a CVSS score of 10.0, indicating critical impact on confidentiality, integrity, and availability.

A fix for this vulnerability is available in commit c08694bf6264eb4decceb78c711baee2609b4efd. Users of WWBN AVideo version 29.0 and earlier should apply this patch or upgrade to a version containing this fix. Since no official vendor advisory or patch link is provided, users should verify the fix by reviewing the referenced commit in the project's repository. Until patched, the platform remains vulnerable to unauthenticated code injection attacks via the YPTSocket plugin.