CVE-2026-54458

{
  "id": "CVE-2026-54458",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-15T22:17:19.160",
  "lastModified": "2026-10-24T21:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. Versions prior to 29.0 contain a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. Any unauthenticated remote attacker can execute arbitrary JavaScript in the authenticated origin of every administrator currently viewing a page that renders the YPTSocket online-users debug panel. plugin/YPTSocket/getWebSocket.json.php issues a signed WebSocket token to any anonymous caller, and MessageSQLiteV2::onOpen at plugin/YPTSocket/MessageSQLiteV2.php lines 91 and 110 reads the attacker-controlled webSocketSelfURI and page_title query parameters from the WebSocket connection URL with no validation. Both values persist into the in-memory SQLite connections table and broadcast inside the users_id_online array sent to every connected client; on the client, plugin/YPTSocket/script.js::updateSocketUserCard interpolates the broadcast page_title into an HTML template literal that is passed to jQuery $.append(html), which parses attacker bytes into live DOM nodes including <img> with inline event handlers. Successful attackers can can read non-HttpOnly cookies and the CSRF token rendered into the admin dashboard, issue authenticated requests to any admin-only endpoint, exfiltrate the admin dashboard DOM, and chain into any admin-context mutation. When the victim is an AVideo administrator, the attacker turns a single anonymous WebSocket connection into full administrative takeover via the admin's own session. This issue has been patched by https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. Las versiones anteriores a la 29.0 contienen una vulnerabilidad de cross-site scripting DOM almacenado en el plugin YPTSocket. Cualquier atacante remoto no autenticado puede ejecutar JavaScript arbitrario en el origen autenticado de cada administrador que esté viendo una página que renderiza el panel de depuración de usuarios en línea de YPTSocket. plugin/YPTSocket/getWebSocket.json.php emite un token WebSocket firmado a cualquier llamador anónimo, y MessageSQLiteV2::onOpen en plugin/YPTSocket/MessageSQLiteV2.php líneas 91 y 110 lee los parámetros de consulta webSocketSelfURI y page_title controlados por el atacante desde la URL de conexión WebSocket sin validación. Ambos valores persisten en la tabla de conexiones SQLite en memoria y se difunden dentro del array users_id_online enviado a cada cliente conectado; en el cliente, plugin/YPTSocket/script.js::updateSocketUserCard interpola el page_title difundido en un literal de plantilla HTML que se pasa a jQuery $.append(html), que analiza los bytes del atacante en nodos DOM activos, incluyendo [img] con manejadores de eventos en línea. Los atacantes exitosos pueden leer cookies no HttpOnly y el token CSRF renderizado en el panel de administración, emitir solicitudes autenticadas a cualquier endpoint solo para administradores, exfiltrar el DOM del panel de administración y encadenar cualquier mutación en contexto de administrador. Cuando la víctima es un administrador de AVideo, el atacante convierte una única conexión WebSocket anónima en una toma de control administrativa completa a través de la propia sesión del administrador. Este problema ha sido parcheado por https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "<= 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "REQUIRED",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "LOW"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 6.0
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-16T14:21:14.803192Z",
          "id": "CVE-2026-54458",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/8be71e53ccbe9b84b30870db386fb4d2b11e1c16",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8whc-2wmv-ww35",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}