WWBN AVideo, an open source video platform, has a stored XSS vulnerability (CWE-79) in versions 29.0 and below. The vulnerability is in the MessageSQLite WebSocket Handler where the autoEvalCodeOnHTML parameter is sanitized only when present in $json['msg'], but the function msgToResourceId() prioritizes $msg['json'], allowing an attacker to bypass sanitization by placing the payload in the json key. This flaw enables an authenticated attacker to execute arbitrary JavaScript in any connected user's browser session, facilitating session hijacking and unauthorized actions via CSRF chaining. The vulnerability affects the default SQLite WebSocket backend configuration. A patch has been committed but is not yet officially released.

An authenticated attacker can execute arbitrary JavaScript in other users' browsers connected via the WebSocket messaging system. This can lead to theft of session cookies and authentication tokens, enabling account takeover. Additionally, attackers can perform administrative actions on behalf of victims by chaining this with CSRF attacks. The vulnerability compromises confidentiality, integrity, and availability of user accounts and potentially the application.

A patch addressing this vulnerability has been committed but is not yet officially released. Users should monitor the official WWBN AVideo repository and apply the official fix once available. Until then, consider restricting WebSocket access to trusted users and environments to reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.