CVE-2026-86188: AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

Published Sep 5, 2026

Updated

AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

Affected Software

2 affected components

AVideo

YPTSocket Plugin

Event History

Sep 5, 2026

CVE Published

via MITRE·12:09 PM

Data Sourced

via MITRE·12:09 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

AVideo deployments with the YPTSocket plugin enabled are exposed. The vulnerable websocket callback mechanism can be reached by unauthenticated attackers over the network.

What does an attacker need to exploit it?

An attacker only needs to send a crafted socket message that invokes a global callback such as avideoConfirmHTML with untrusted data. No authentication or victim interaction is required.

What is the impact on affected users?

The crafted callback data is assigned to innerHTML, allowing arbitrary JavaScript to execute in another user's browser under the AVideo site's origin. This can affect confidentiality and integrity in the victim's browser session.

CVE-2026-86188: AVideo YPTSocket Plugin Unauthenticated Cross-Site Scripting

Affected Software

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact on affected users?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the impact on affected users?