CVE-2026-54458 is a stored DOM XSS vulnerability in WWBN AVideo's YPTSocket plugin affecting versions before 29.0. The plugin issues signed WebSocket tokens to anonymous callers and reads attacker-controlled parameters (webSocketSelfURI and page_title) from the WebSocket URL without validation. These values are stored in an in-memory SQLite table and broadcast to all connected clients. On the client side, the page_title is interpolated into an HTML template literal and appended to the DOM via jQuery, enabling execution of attacker-supplied JavaScript. This allows attackers to steal cookies, CSRF tokens, exfiltrate admin dashboard DOM, and perform authenticated admin actions, effectively resulting in full administrative takeover through a single anonymous WebSocket connection. The issue is fixed in version 29.0.

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary JavaScript in the context of authenticated administrators. This leads to theft of sensitive cookies and CSRF tokens, exfiltration of the admin dashboard DOM, and the ability to perform any administrative action, resulting in complete administrative account takeover. The vulnerability has a CVSS score of 9.6 (critical).

A fix is available in WWBN AVideo version 29.0. Users should upgrade to version 29.0 or later to remediate this vulnerability. No other mitigations are specified. Patch status is confirmed by the vendor's public commit fixing the issue.