CVE-2026-43878

WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal

View on CVE.org

Published May 11, 2026 CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Description

WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a <script> block. An attacker who sends a victim to a crafted URL can break out of the string and execute arbitrary JavaScript in the victim's browser in the context of the AVideo origin. No authentication is required if a public Meet schedule exists on the target. Commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b contains an updated fix.

Analysis

Technical impact

The vulnerability arises from the Meet plugin of WWBN AVideo, where the user and pass query parameters are directly echoed into a JavaScript string literal without proper escaping. An attacker can craft a URL that injects a closing quote and arbitrary JavaScript code, causing the victim’s browser to execute that code within the AVideo domain. This enables session hijacking, credential theft, or other attacks that rely on executing code in the victim’s context. The weakness is an input validation failure (CWE‑79).

Affected Systems

Affected installations are WWBN AVideo versions 29.0 and earlier. The vulnerability is present in the plugin/Meet/iframe.php script where the parameters are reflected. Upgrading to a version that includes the commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b resolves the issue.

Risk and Exploitability

The CVSS score is 6.1, indicating a moderate severity risk. The EPSS score is not available and the vulnerability is not listed in CISA KEV, suggesting no widespread exploitation reports yet. However, the flaw does not require authentication and can be triggered by any user who visits a malicious URL to a Meet that is publicly scheduled, making it a realistic threat for exposed installations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

WWBN

AVideo

affected

Version	Status	Constraints
`<= 29.0`	affected	—

No data.

Vendor Product Versions

Wwbn

Avideo

Version	Status	Scheme	Platform
`[0,29.0]`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the patch included in commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b or upgrade to a version newer than 29.0 that contains the fix
Restrict access to public Meet schedules or remove public scheduling features until the patch is applied
Implement proper input validation or escaping for all parameters that are rendered within JavaScript contexts to guard against future injection flaws

Generated by OpenCVE AI on May 11, 2026 at 22:58 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-mm5f-8q57-4fc4	Video: Reflected XSS in plugin/Meet/iframe.php via Unescaped user and pass Parameters in JavaScript String Literal

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.253% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact partial

References

Link	Providers
https://github.com/WWBN/AVideo/commit/3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b
https://github.com/WWBN/AVideo/security/advisories/GHSA-mm5f-8q57-4fc4

History

May 12, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 11, 2026 11:30 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Wwbn Wwbn avideo
Vendors & Products		Wwbn Wwbn avideo

May 11, 2026 9:30 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a <script> block. An attacker who sends a victim to a crafted URL can break out of the string and execute arbitrary JavaScript in the victim's browser in the context of the AVideo origin. No authentication is required if a public Meet schedule exists on the target. Commit 3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b contains an updated fix.
Title		WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameters Reflected into JavaScript String Literal
Weaknesses		CWE-79
References		https://github.com/WWBN/AVideo/commit/3298ced2bcf92e4f3acff6ce9bde14edf42ecb5b https://github.com/WWBN/AVideo/security/advisories/GHSA-mm5f-8q57-4fc4
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`