GitHub Security Advisory: GHSA-2mg4-pfgx-64cf
Package: wwbn/avideo (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-613: Insufficient Session Expiration
Vulnerable versions: <= 26.0
Patched in: unpatched

Summary: AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()

Details:
## Summary

The `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legitimately obtained tokens to provide permanent WebSocket access, even after user accounts are deleted, banned, or demoted from admin. Admin tokens grant access to real-time connection data for all online users including IP addresses, browser info, and page locations.

## Details

WebSocket tokens are generated via `getEncryptedInfo()` which calls `getToken(43200)` to create a token with a 12-hour expiration window. The token is encrypted and contains security-critical claims: `isAdmin`, `from_users_id`, `user_name`, IP, browser, and device ID.

The regular HTTP token verification at `objects/functions.php:3437-3439` enforces the timeout:

```php
// objects/functions.php:3437-3439
if (!($time >= $obj->time && $time <= $obj->timeout)) {
    _error_log("verifyToken token timout...");
    return false;  // <-- enforced
}
```

But the WebSocket-specific verification at `plugin/YPTSocket/functions.php:65-82` has the enforcement commented out:

```php
// plugin/YPTSocket/functions.php:77-80
if (!($time >= $obj->time && $time <= $obj->timeout)) {
    //_error_log("verifyToken token timout...");
    //return false;  // <-- NOT enforced, always falls through to return true
}
return true;
```

**Execution flow:**

1. Client connects to WebSocket with `?webSocketToken=TOKEN` in URL query
2. `onOpen()` (Message.php:34) calls `getDecryptedInfo($wsocketGetVars['webSocketToken'])` (line 48)
3. `getDecryptedInfo()` (functions.php:49) decrypts the token and calls `verifyTokenSocket($json->token)` (line 54)
4. `verifyTokenSocket()` validates the salt (passes) but the timeout check at line 77 evaluates the condition without acting on failure — `return false` is commented out
5. Function returns `true` — connection established with all token claims (`isAdmin`, `from_users_id`) trusted

**Impact amplification via isAdmin:**

When a connection has `isAdmin=true` (from token, Message.php:58), the `getTotals()` function (Message.php:419-432) includes detailed data about every connected client in periodic broadcast messages:

```php
// Message.php:419-432
if ($isAdmin) {
    $index = md5($client['selfURI']);
    // Exposes: selfURI, yptDeviceId, users_id, user_name, browser, ip, location
    $return['users_uri'][$index][$client['yptDeviceId']][$client['users_id']] = $client;
}
```

Additionally, the `webSocketToken` message type (Message.php:212-217) allows anonymous connections (`users_id=0`) to upgrade their identity by providing a captured token, meaning stolen tokens work from new connections indefinitely.

The 10-minute inactivity timeout (Message.php:135-143) is not a mitigation — it only closes idle connections and resets on every message (line 243).

## PoC

```bash
# Step 1: Obtain a WebSocket token as any authenticated