Listen to this Post
How the Mentioned CVE Works
The vulnerability exists in the `verifyTokenSocket()` function located at plugin/YPTSocket/functions.php. WebSocket tokens are generated with a 12-hour expiration (getToken(43200)) and contain critical claims like isAdmin, user_id, and IP. Standard HTTP token verification in `objects/functions.php` enforces this timeout, rejecting expired tokens. However, the WebSocket-specific verification function has the timeout enforcement code commented out. Specifically, lines 77-80 evaluate the expiration condition but the `return false` statement is disabled, causing the function to always return `true` for any token with a valid salt. When a client connects using the `webSocketToken` query parameter, `onOpen()` in `Message.php` calls getDecryptedInfo(), which invokes this broken verification. Consequently, tokens never expire. If a compromised or legitimately obtained token contains isAdmin=true, the server grants permanent admin-level WebSocket access. This allows the attacker to receive periodic broadcasts via `getTotals()` that expose all connected clients’ IPs, browser info, device IDs, and page URIs. Additionally, the `webSocketToken` message type allows anonymous connections to upgrade their identity using any captured token, enabling indefinite impersonation. This persists even if the original user account is deleted, banned, or demoted from admin, as the token claims are never re-validated against the database.
DailyCVE Form
Platform: AVideo YouPHPTube
Version: Prior to 15.0
Vulnerability: WebSocket Token Expiry
Severity: Critical
date: 2026-03-31
Prediction: 2026-04-15
What Undercode Say:
Analytics
The flaw lies in a commented timeout check, rendering token expiration logic inert. Attackers leverage this for persistent surveillance and privilege escalation.
Capture a valid WebSocket token
curl -s -b 'PHPSESSID=VICTIM_SESSION' 'https://target.com/plugin/YPTSocket/getWebSocket.json.php' | jq -r '.webSocketToken'
Connect using the expired/stolen token (no timeout enforcement)
wscat -c 'ws://target.com:8888/?webSocketToken=STOLEN_TOKEN'
Enumerate all connected clients without admin rights
{"msg":"getClientsList","webSocketToken":"STOLEN_TOKEN"}
Exploit:
- Obtain any WebSocket token (via session hijacking, XSS, or legit capture).
- Wait beyond the 12-hour expiration or use a token from a demoted/deleted user.
- Connect via WebSocket with the expired token; verification bypass succeeds.
- If the token has
isAdmin: true, receive all user metrics; otherwise, use `getClientsList` to map users.
Protection from this CVE
- Uncomment the timeout enforcement in `plugin/YPTSocket/functions.php` lines 77-80 to enable `return false` on expiration.
- Implement database re-validation of `isAdmin` status for every WebSocket message or periodically.
- Restrict `getClientsList` handler to admin-only connections at
Message.php:219.
Impact
- Permanent Access: Revoked users retain WebSocket access indefinitely.
- Privilege Persistence: Demoted admins keep admin-level data visibility.
- Real-time Surveillance: Exposure of IPs, locations, and browsing activity.
- Extended Attack Window: Token theft yields permanent rather than temporary access.
- Identity Hijacking: Stolen tokens allow full impersonation in real-time features.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
