WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts through session hijacking, and chaining with CSRF to perform admin actions on the victim's behalf, in the default SQLite WebSocket backend configuration. This issue has a patch that has yet to be officially released, see https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23.
WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any user who can solve a CAPTCHA to self-grant elevated permissions during account registration. The set_api_signUp method in the API plugin accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applies them to newly created accounts without verifying that the request was authenticated with a valid APISecret. By self-granting account attributes, attackers can mark their own accounts as email-verified without owning the address (bypassing email-gated functionality) and award themselves upload, streaming, and meeting-creation permissions, circumventing administrator access controls that intentionally restrict these capabilities for new users. This issue has been fixed in version 29.0
AVideo TopMenu plugin through version 26.0 contains a stored cross-site scripting vulnerability in menu item rendering due to missing output encoding of icon classes, URLs, and text labels. Attackers can inject malicious JavaScript through unescaped menu item fields that execute for all site visitors, potentially stealing session cookies or performing unauthorized actions.
WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a stored cross-site scripting vulnerability. The Live plugin's "YouTube-style" view renders the live transmission's stream key into an HTML class attribute by raw echo, without htmlspecialchars(). A canStream user can persist a key containing " plus an event handler via plugin/Live/saveLive.php, and any visitor (logged in or anonymous) opening the stream's live page executes attacker JavaScript in the platform origin.
WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.
WWBN AVideo is an open source video platform. In 29.0 and earlier, there is a cross-site request forgery vulnerability on the 2FA toggle.plugin/LoginControl/set.json.php accepts POST type=set2FA value=false, calls LoginControl::setUser2FA(User::getId(), false) on the session-authenticated user, and returns. There is no forbidIfIsUntrustedRequest() call, no isTokenValid() check, no X-CSRF-Token/SameSite enforcement, and no re-authentication step. A cross-origin page that the victim visits while logged into the AVideo dashboard issues the POST via a hidden form (or fetch without credentials:"omit") and disables the victim's 2FA in one request.
WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.
WWBN AVideo versions 29.0 and earlier contain a vulnerability in the objects/mention.json.php endpoint that allows unauthenticated user enumeration. The endpoint lacks proper authentication checks such as User::loginCheck() or admin gate, relying only on a weak entry guard that matches a request parameter. This flaw enables attackers to enumerate users without authentication. The vulnerability is assigned CVE-2026-45620 with a medium severity and a CVSS score of 5.3. No official patch or remediation guidance is currently available from the vendor.
WWBN AVideo is an open source video platform. In 29.0 and earlier, view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.
WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.
WWBN AVideo versions 29.0 and earlier contain a stored cross-site scripting (XSS) vulnerability in the category description field. This occurs because category descriptions are stored from user input and rendered as raw HTML in the Gallery view without proper neutralization. A user with permission to create or edit categories can inject JavaScript code that executes when other users view the affected category page. This vulnerability is distinct from previously fixed XSS issues in video titles or comments. The CVSS score is 5.4, indicating a medium severity risk.
WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating
any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an unauthenticated user can read APISecret from objects/plugins.json.php and use it to call protected API endpoints (e.g.users_list) without logging in. Commit 1c36f229d0a103528fb9f64d0a1cc0e1e8f5999b contains an updated fix.
WWBN AVideo versions up to and including 29.0 contain a Server-Side Request Forgery (SSRF) vulnerability in two endpoints that validate user-supplied URLs but do not properly handle HTTP redirects. An attacker can exploit this by providing a URL that redirects to internal or cloud metadata addresses, bypassing SSRF protections. This vulnerability has a high severity score of 7.7 and affects confidentiality but not integrity or availability.
WWBN AVideo versions up to and including 29.0 contain an authorization bypass vulnerability in the PayPal billing agreement cancellation endpoint. A low-privilege authenticated user can supply another user's PayPal billing agreement ID to cancel that user's recurring subscription without ownership verification. This can lead to revenue loss for the platform and loss of paid service for the victim. A fix has been committed but no official patch or vendor advisory is currently confirmed.
WWBN AVideo is an open source video platform. In versions up to and including 29.0, the unauthenticated plugin/Scheduler/downloadICS.php endpoint passes attacker-controlled title, description, and joinURL parameters into Scheduler::downloadICS(), which builds an ICS calendar file via the ICS helper class. ICS::escape_string() (objects/ICS.php:167-169) only escapes , and ; and does NOT neutralize CR/LF, so attacker CRLF bytes inside a property value break out and inject arbitrary ICS lines — including END:VEVENT / BEGIN:VEVENT pairs that add entire attacker-controlled calendar events. Because the malicious .ics file is served from the victim's trusted AVideo origin, this enables high-credibility calendar phishing: forged meetings with attacker-chosen SUMMARY, URL, LOCATION, and DESCRIPTION landing in the victim's calendar after import. Commit 764db592f99e545aa86bb9a4ad664ffd14c38ba5 contains an updated fix.
CVE-2026-43881 is a medium severity vulnerability in WWBN AVideo versions up to and including 29.0. It involves missing authentication checks in the objects/users.json.php endpoint, which exposes user account information without requiring authentication. Specifically, an isCompany parameter bypasses admin-only restrictions, and a second path allows retrieval of individual user details without permission checks. This leads to disclosure of user IDs, display names, channel URLs, photos, backgrounds, statuses, and total account counts. No official patch or remediation guidance is currently confirmed.
CVE-2026-43880 is a medium severity vulnerability in WWBN AVideo versions up to and including 29.0. The vulnerability exists in the objects/sendEmail.json.php endpoint, which allows unauthenticated attackers to send emails using the site's legitimate SMTP infrastructure. This endpoint is explicitly allow-listed as a public write action and requires no authentication or CSRF token. An attacker who solves a captcha can supply arbitrary recipient email addresses and cause the site to send emails that appear to come from the site's own domain, passing SPF, DKIM, and DMARC checks. This can facilitate targeted phishing and brand impersonation attacks. A fix has been committed but no official patch or vendor advisory is currently provided.
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g.http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses). When any other user (including a second account owned by the same attacker) donates even a trivial amount via plugin/CustomizeUser/donate.json.php, the AVideo server issues a curl POST to the attacker-supplied URL, resulting in a blind SSRF. The handler uses only isValidURL() (which is a format check) and does not call the codebase's own isSSRFSafeURL() helper. Additionally, CURLOPT_FOLLOWLOCATION is enabled with no per-hop revalidation, so even if the stored URL were validated, an HTTP 307 from an attacker-controlled host could redirect the POST to internal targets. Commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9 contains an updated fix.
CVE-2026-43878 is a cross-site scripting (XSS) vulnerability in WWBN AVideo versions up to and including 29.0. The vulnerability occurs in the plugin/Meet/iframe.php file where attacker-controlled user and pass parameters are echoed unescaped inside a JavaScript string within a script block. This allows an attacker to craft a URL that executes arbitrary JavaScript in a victim's browser under the AVideo origin. No authentication is required if a public Meet schedule exists. A fix has been committed but no official patch release information is provided.