CVE-2026-40911 is a critical code injection vulnerability in WWBN AVideo versions 29.0 and earlier. The YPTSocket plugin's WebSocket server relays attacker-controlled JSON message fields without sanitization, which are then passed to eval() calls on connected clients. This allows an unauthenticated attacker to execute arbitrary JavaScript in the context of all connected users, including administrators. The vulnerability enables universal account takeover, session theft, and execution of privileged actions. A fix is available in commit c08694bf6264eb4decceb78c711baee2609b4efd.
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and write arbitrary `.php` files to any writable location on the filesystem, achieving Remote Code Execution. Commit 57f89ffbc27d37c9d9dd727212334846e78ac21a fixes the issue.
WWBN AVideo versions 29.0 and earlier contain a vulnerability where the file git.json.php executes a git log command and returns its output as JSON to any unauthenticated user. This behavior exposes sensitive information including the exact deployed commit hash, developer names and email addresses, and commit messages. Such exposure can enable version fingerprinting and reveal personally identifiable information (PII) and potentially sensitive internal references. No patched versions are currently available for this vulnerability. The CVSS score is 5.3, indicating a medium severity level.
WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch. Commit d5992fff2811df4adad1d9fc7d0a5837b882aed7 fixes the issue.
CVE-2026-39370 is a Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo versions 26.0 and earlier. The vulnerability arises because the application allows attacker-controlled downloadURL parameters with common media or archive file extensions to bypass SSRF validation. An authenticated uploader can exploit this to make the server fetch arbitrary URLs and store the response as media content. This issue is due to an incomplete fix for a previous SSRF vulnerability (CVE-2026-27732). The vulnerability has a high severity score of 7.1 and impacts confidentiality but not availability or integrity.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.
WWBN AVideo versions 26.0 and earlier contain a cross-site scripting (XSS) vulnerability in the Electronic Program Guide (EPG) feature. The vulnerability arises because the EPG parses XML from user-controlled URLs and directly renders <title> elements into HTML without sanitization or escaping. An authenticated user with upload permissions can exploit this by setting a video's epg_link to a malicious XML file containing JavaScript in the <title> elements. This malicious script executes in the browsers of unauthenticated visitors to the public EPG page, potentially allowing session hijacking and account takeover. The vulnerability has a CVSS score of 5.4, indicating medium severity. No official patch or remediation guidance is currently available.
WWBN AVideo versions 26.0 and earlier contain a vulnerability in the PayPal IPN v1 handler (plugin/PayPalYPT/ipn.php) where transaction deduplication is missing. This allows an attacker with limited privileges to replay a legitimate PayPal IPN notification multiple times, inflating their wallet balance and renewing subscriptions improperly. Newer handlers (ipnV2.php and webhook.php) implement proper deduplication, but the vulnerable v1 handler remains in use for billing plans. The vulnerability has a CVSS score of 6.5, indicating medium severity, with a primary impact on integrity. No official patch or remediation guidance is currently available from the vendor.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/CloneSite/client.log.php endpoint serves the clone operation log file without any authentication. Every other endpoint in the CloneSite plugin directory enforces User::isAdmin(). The log contains internal filesystem paths, remote server URLs, and SSH connection metadata.
WWBN AVideo versions 26.0 and earlier contain a vulnerability where the plugin/API/check.ffmpeg.json.php endpoint exposes FFmpeg remote server connectivity status without requiring authentication. This contrasts with other FFmpeg management endpoints that do require administrative privileges. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function) and has a CVSS 3.1 base score of 5.3, indicating medium severity.
WWBN AVideo versions 26.0 and earlier contain a vulnerability where the install/test.php diagnostic script is accessible via HTTP due to a disabled CLI-only access guard. This exposure allows unauthenticated users to view sensitive information such as video viewer IP addresses, session IDs, and user agents. The vulnerability is classified as CWE-200, indicating exposure of sensitive information to unauthorized actors. The CVSS score is 5.3, reflecting a medium severity impact primarily on confidentiality. No official patch or remediation guidance is currently documented by the vendor. There are no known exploits in the wild at this time.
CVE-2026-35448 is a missing authorization vulnerability in the BlockonomicsYPT plugin of WWBN AVideo versions 26.0 and earlier. The plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication or access control. This endpoint was intended as an AJAX helper for authenticated users but lacks proper authorization checks, allowing anyone to query payment records tied to any Bitcoin address used on the platform. The vulnerability has a low severity score and no known exploits in the wild. No official patch or remediation guidance is currently available.
WWBN AVideo versions 26.0 and earlier contain a Cross-Site Request Forgery (CSRF) vulnerability in the player skin configuration endpoint (admin/playerUpdate.json.php). This endpoint does not validate CSRF tokens, and the plugins table is excluded from domain-based security checks, removing additional protection. Because the platform uses SameSite=None cookies, an attacker can perform a cross-origin POST request to modify the video player appearance across the platform. The vulnerability has a CVSS score of 4.3, indicating medium severity.
WWBN AVideo versions 26.0 and earlier have a Cross-Site Request Forgery (CSRF) vulnerability in the site customization endpoint admin/customize_settings_nativeUpdate.json.php. This endpoint lacks CSRF token validation and writes uploaded logo files to disk before performing domain-based security checks. Due to the platform's SameSite=None cookie policy, an attacker can perform a cross-origin POST request to overwrite the platform's logo with attacker-controlled content. The vulnerability has a CVSS score of 4.3, indicating medium severity.
WWBN AVideo versions 26.0 and earlier contain a missing authorization vulnerability in the SocialMediaPublisher plugin. The publishInstagram.json.php endpoint acts as an unauthenticated proxy to the Facebook/Instagram Graph API, accepting user-controlled parameters including access tokens and Instagram account IDs. This allows unauthenticated users to make arbitrary Graph API calls through the server, potentially abusing stolen tokens or the platform's credentials. The vulnerability has a medium severity with a CVSS score of 5.3. No official patch or remediation guidance has been provided by the vendor as of the publication date.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the EPG (Electronic Program Guide) link feature in AVideo allows authenticated users with upload permissions to store arbitrary URLs that the server fetches on every EPG page visit. The URL is validated only with PHP's FILTER_VALIDATE_URL, which accepts internal network addresses. Although AVideo has a dedicated isSSRFSafeURL() function for preventing SSRF, it is not called in this code path. This results in a stored server-side request forgery vulnerability that can be used to scan internal networks, access cloud metadata services, and interact with internal services. At time of publication, there are no publicly available patches.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the User_Location plugin's testIP.php page reflects the ip request parameter directly into an HTML input element without applying htmlspecialchars() or any other output encoding. This allows an attacker to inject arbitrary HTML and JavaScript via a crafted URL. Although the page is restricted to admin users, AVideo's SameSite=None cookie configuration allows cross-origin exploitation, meaning an attacker can lure an admin to a malicious link that executes JavaScript in their authenticated session. At time of publication, there are no publicly available patches.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. At time of publication, there are no publicly available patches.