CVE-2026-40911PoC(wwbn / avideo)

LOWCVSS 10.0 · CRITICAL

Exploit discussion active in current signal (1 latest mentions)

Immediate actions

Hunt for exploitation attempts and persistence artifacts
Increase monitoring for publicly documented tradecraft
Track advisory updates for patch or workaround availability

Recommended action window: High priority (within 72h)

NVD description

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated beyond decryption, an unauthenticated attacker can broadcast arbitrary JavaScript that executes in the origin of every currently-connected user (including administrators), resulting in universal account takeover, session theft, and privileged action execution. Commit c08694bf6264eb4decceb78c711baee2609b4efd contains a fix.

wwbn CVEs Back to dashboard

1.5/ 10 priority

Sources & remediation

Patch / fix

https://github.com/WWBN/AVideo/commit/c08694bf6264eb4decceb78c711baee2609b4efd

Exploit / PoC references

Weakness type (CWE)

CWE-94

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

avideo

Threat summary

Public PoC is present in monitored signal
3 mentions across 3 observed days
Momentum state: stable

What's happening

PoC mentioned or linked in 1 signal
Technical details provided in 2 signals
General: 1 classified signal
Disclosure: 1 classified signal
Peaked 2d ago at 1 mentions (2026-04-21); latest day: 1
3 total mentions across 3 days

Affected systems

Vendors

wwbn

Products

avideo

Deep dive

Activity timeline3 mentions / 3d

Signal classification3 categories

PoC

133.3%

General

133.3%

Disclosure

133.3%

Referenced assets3 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-21	1	PoC1
2026-04-22	1	General1
2026-04-27	1	Disclosure1

Full discourse3 posts

CVE@CVEnew163d
Disclosure
CVE-2026-40911 WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to ever… https://www.cve.org/CVERecord?id=CVE-2026-40911
Post summary
The text announces CVE‑2026‑40911, describing a vulnerability in the YPTSocket plugin that forwards attacker‑supplied JSON via WebSocket, but does not provide a PoC, exploit, patch, or evidence of active exploitation.
00010140
57.3K followersView on X
0day Signal@0dayPublishing169d
PoC
🚨 CVE-2026-40911: WWBN AVideo YPTSocket WebSocket ... WebSocket relay + client-side eval() = instant mass XSS across all connected users including admins via unauthenticated... https://zerodaysignal.com/vulnerability/CVE-2026-40911 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
CVE-2026-40911 is a mass XSS vulnerability via a WebSocket relay and client-side eval, affecting all users including admins; a PoC is referenced at the provided URL.
0000165
218 followersView on X
CTIWatch@ctiwatchcloud169d
General
🔍 Today's Top Vulnerabilities 🔴 CVE-2025-15638 | CVSS 10.0 🔴 CVE-2026-40911 | CVSS 10.0 🔴 CVE-2017-20230 | CVSS 10.0 🔗 http://ctiwatch.cloud/vulnerabilities #CVE #Vulnerability #ThreatIntel
Post summary
The tweet merely lists several high‑CVSS CVEs without providing any detail on exploitation, fixes, or contextual evidence, thus it falls under a general mention with high confidence.
00000345
5.6K followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wwbn	avideo	-	-	-

Explore more

Back to dashboard wwbn CVEs avideo vulnerabilities