AVideo with YPTSocket plugin enabled contains a cross-site scripting vulnerability allowing unauthenticated attackers to execute arbitrary JavaScript in other users' browsers via the websocket callback mechanism. Attackers can send crafted socket messages with callback names resolving to global functions like avideoConfirmHTML that accept untrusted data and assign it to innerHTML, achieving script execution in the victim's origin without authentication or user interaction.

AVideo, when the YPTSocket plugin is enabled, contains a cross-site scripting (XSS) vulnerability tracked as CVE-2026-86188. Unauthenticated attackers can exploit this flaw by sending crafted WebSocket messages with callback names that resolve to global JavaScript functions such as avideoConfirmHTML. These functions accept untrusted data and assign it directly to innerHTML, enabling arbitrary JavaScript execution in the victim's browser. The attack requires no authentication and no user interaction beyond the victim having the application open. Script execution occurs within the victim's origin, potentially allowing session hijacking, credential theft, or other malicious actions. The vulnerability is present in the websocket callback mechanism of the YPTSocket plugin. It has been documented by both the official GitHub security advisory and VulnCheck. The issue poses a high risk due to its unauthenticated and zero-interaction nature.