WWBN AVideo, an open source video platform, suffers from an improper neutralization of input during web page generation (CWE-79) in versions up to 29.0. Specifically, the plugin/Meet/iframe.php script echoes user-supplied 'user' and 'pass' query parameters directly into a JavaScript double-quoted string literal without escaping. This flaw enables an attacker to break out of the string context and execute arbitrary JavaScript code in the victim's browser, leveraging the AVideo origin. Exploitation requires the victim to visit a crafted URL, and no authentication is needed if a public Meet schedule is available. A code commit (3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b) contains a fix, but no official patch or vendor advisory is referenced.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected AVideo instance, potentially leading to information disclosure or session hijacking. The vulnerability does not require authentication if a public Meet schedule exists. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability.

A code fix has been committed to address this vulnerability; users should update to a version including commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b or later. Since no official patch release or vendor advisory is available, verify with the WWBN AVideo project for updated releases containing this fix. Until patched, avoid exposing public Meet schedules or restrict access to mitigate exploitation risk. Patch status is not yet confirmed — check the vendor advisory or project repository for current remediation guidance.