CVE-2026-50183

{
  "id": "CVE-2026-50183",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T22:16:54.643",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. Versions 29.0 and below contain a stored Cross-Site Scripting vulnerability in the YouTubeAPI plugin. The plugin renders the snippet.title field returned by the YouTube Data API into the homepage gallery markup with no HTML encoding. The title is set by the YouTube video uploader (anyone in the world) and is treated by AVideo as trusted content. A YouTube uploader who controls a video matching the operator's configured query injects HTML into the AVideo homepage by setting their video's title to a JavaScript-bearing string; the payload then executes in the browser of every visitor who loads any page that renders the gallery. When the visitor is an AVideo administrator, the injected JavaScript performs any admin action (create user, promote to admin, change configuration, install plugin) that uses cookie-based authentication without an additional CSRF token, escalating the bug into full administrative takeover. The payload persists for the duration of cacheTimeout (default 3600 seconds) after the malicious title is set on YouTube and survives YouTube removing the hostile video for the same window. This issue has been addressed by commit https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. Las versiones 29.0 e inferiores contienen una vulnerabilidad de cross-site scripting almacenada en el plugin YouTubeAPI. El plugin renderiza el campo snippet.title devuelto por la API de datos de YouTube en el marcado de la galería de la página de inicio sin codificación HTML. El título es establecido por el cargador de videos de YouTube (cualquiera en el mundo) y es tratado por AVideo como contenido de confianza. Un cargador de YouTube que controla un video que coincide con la consulta configurada del operador inyecta HTML en la página de inicio de AVideo al establecer el título de su video a una cadena que contiene JavaScript; la carga útil luego se ejecuta en el navegador de cada visitante que carga cualquier página que renderiza la galería. Cuando el visitante es un administrador de AVideo, el JavaScript inyectado realiza cualquier acción de administrador (crear usuario, promover a administrador, cambiar configuración, instalar plugin) que utiliza autenticación basada en cookies sin un token CSRF adicional, escalando el error a una toma de control administrativa completa. La carga útil persiste durante la duración de cacheTimeout (predeterminado 3600 segundos) después de que el título malicioso se establece en YouTube y sobrevive a que YouTube elimine el video hostil durante la misma ventana. Este problema ha sido abordado por el commit https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "<= 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "baseScore": 4.7,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "HIGH",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.6,
        "impactScore": 2.7
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T12:50:36.539962Z",
          "id": "CVE-2026-50183",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/7292129eaee5f609beae103b5cb387d55f17b877",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-66q5-cj5g-wrfx",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-66q5-cj5g-wrfx",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}