What is the CVSS score of CVE-2026-29093?

CVE-2026-29093 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-29093?

WWBN AVideo installations prior to version 24.0 expose an unauthenticated memcached service that stores all user sessions, allowing attackers with network access to hijack admin accounts, impersonate…

How to fix or mitigate CVE-2026-29093?

Within 24 hours: Identify all WWBN AVideo deployments running versions prior to 24.0 and restrict network access to port 11211 using firewall rules (allow only internal application servers). Within 7 days: Upgrade to AVideo version 24.0 or later, which remedies the insecure docker-compose configuration, or disable memcached session storage in favor of secure alternatives. Within 30 days: Conduct a security audit of all deployed instances, rotate admin credentials, review session logs for unauthorized access patterns, and implement network segmentation to prevent future unauthorized service exposure.

PHP CVE-2026-29093

HIGH

Improper Authentication (CWE-287)

2026-03-06 security-advisories@github.com

GHSA-xxpw-32hf-q8v9

PHP Docker Authentication Bypass Avideo

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:06 vuln.today

CVE Published

Mar 06, 2026 - 04:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data - enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.

AnalysisAI

Memcached session storage exposure in AVideo prior to version 24.0 allows unauthenticated remote attackers to read, modify, or delete user sessions by accessing the publicly exposed memcached service on port 11211. An attacker with network access to this port can hijack admin accounts, impersonate users, or destroy all active sessions without any authentication. This affects the official Docker deployment configuration for PHP, Docker, and AVideo products.

Technical ContextAI

This vulnerability (CWE-287: Improper Authentication) affects WWBN AVideo is an open source video platform.. WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has