We are developing a web application. It has several features so the first time the user enters it shows a short video explaining how to use it. We use the iframe approach to embed a video from YouTube (or potentially other streaming services like Vimeo, MS Stream, etc.). The video only shows for authenticated users (we use OpenId + OAuth2) and it will always be a video published by us (no third party content).
Talking with some colleagues about the potential security risks of this approach someone commented that it is not a good idea to embed external content in an authenticated web page because it is a hole through which a malicious user could inject code or gain access to information. Under the hypothesis that the streaming platform used (YouTube, Vimeo, etc.) is secure, and given that the content is controlled by us, I assume there is no security risk here. Googling about it has only reassured this idea. However, I am no expert, so I was wondering if there is something I am missing. Which are the security risks related to use an external video streaming provider in an authenticated web page?
On the other hand, supposing there are risks, I understand the alternative would be to host the video content directly on our servers, but that seems it is not a good idea either. Which are the security risks in this case?