WWBN AVideo CVE-2026-41056
HIGH
GHSA-ccq9-r5cw-5hwq
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Attacker needs no privileges (PR:N) but the victim must be logged in and visit a malicious page (UI:R); credentialed CORS yields high confidentiality/integrity but no availability impact.
Primary rating from GitHub Advisory.
CVSS VectorGitHub Advisory
Lifecycle Timeline
3DescriptionGitHub Advisory
WWBN AVideo is an open source video platform. In versions 29.0 and below, the allowOrigin($allowAll=true) function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both plugin/API/get.json.php and plugin/API/set.json.php - the primary API endpoints that handle user data retrieval, authentication, livestream credentials, and state-changing operations. Combined with the application's SameSite=None session cookie policy, any website can make credentialed cross-origin requests and read authenticated API responses, enabling theft of user PII, livestream keys, and performing state changes on behalf of the victim. Commit caf705f38eae0ccfac4c3af1587781355d24495e contains a fix.
AnalysisAI
Cross-origin account takeover in WWBN AVideo (versions 29.0 and below) allows any attacker-controlled website to read authenticated API responses and issue state-changing requests on behalf of a logged-in victim. The allowOrigin(true) routine reflects the attacker's Origin header into Access-Control-Allow-Origin while also sending Access-Control-Allow-Credentials: true, and combined with the app's SameSite=None session cookie the victim's browser attaches credentials to cross-origin calls to the core get.json.php/set.json.php API. Proof-of-concept exploitation is documented in the GitHub advisory; EPSS is very low (0.04%) and it is not in CISA KEV, so no confirmed active exploitation exists.
Technical ContextAI
AVideo is an open-source PHP video/livestream platform (cpe:2.3:a:wwbn:avideo). The flaw is a classic CWE-942 permissive cross-origin policy: the allowOrigin($allowAll=true) helper in objects/functions.php was intended to serve public ad XML (VAST/VMAP for the IMA SDK) and therefore echoed any request Origin back with credentials allowed. However, the same allowOrigin(true) call gates both plugin/API/get.json.php and plugin/API/set.json.php - the primary endpoints for user data, authentication, livestream credentials, and state changes. Because CORS with Access-Control-Allow-Credentials: true plus a reflected origin defeats the Same-Origin Policy, and the session cookie is set with SameSite=None (objects/include_config.php:144), the browser transmits the victim's session on cross-origin requests, which the API trusts via $_SESSION['user']['id']. For a user's own profile, removeSensitiveUserFields is bypassed, exposing email, name, address, phone, birth date, admin flags, the livestream server URL with embedded password, and the encrypted stream key.
RemediationAI
Upstream fix available (PR/commit); released patched version not independently confirmed - apply the change in commit caf705f38eae0ccfac4c3af1587781355d24495e (https://github.com/WWBN/AVideo/commit/caf705f38eae0ccfac4c3af1587781355d24495e), which makes the $allowAll=true path validate the Origin the same way as the strict path: only the site's own origin (derived from webSiteRootURL) is reflected with credentials, while all third-party origins receive a wildcard without credentials. Because the package advisory lists no fixed release version (fixed: None), operators tracking tagged releases should build from the patched commit or pull the latest main branch and confirm the diff is present. As compensating controls until patched, consider setting the session cookie to SameSite=Lax in objects/include_config.php (trade-off: may break legitimate embedded/cross-site player flows that rely on cross-origin credentialed calls), or place a reverse proxy in front of plugin/API/get.json.php and set.json.php that strips reflected Access-Control-Allow-Origin/Access-Control-Allow-Credentials headers for non-site origins (trade-off: can break legitimate ad-tech/IMA VAST fetches and any third-party integrations). Mobile apps use APISecret token auth rather than session cookies and are unaffected by tightening credentialed CORS.
More in Cors Misconfiguration
View allCasdoor is a UI-first Identity and Access Management (IAM) / Single-Sign-On (SSO) platform. Rated high severity (CVSS 8.
In Eclipse Theia 0.3.9 to 1.8.1, the "mini-browser" extension allows a user to preview HTML files in an iframe inside th
Bruno is an open source IDE for exploring and testing APIs. Rated high severity (CVSS 8.7), this vulnerability is no aut
memos is a privacy-first, lightweight note-taking service. Rated high severity (CVSS 8.1), this vulnerability is remotel
Cross-origin read bypass in Electron's custom protocol handler exposes sensitive application data to remote pages via fe
Information disclosure in Progress MOVEit Transfer (all versions before 2025.1.5, and 2026.0.0 before 2026.0.3) stems fr
Sensitive-data exposure in Cohere North AI v1.1.5 stems from the server accepting cross-origin requests without validati
SCG Policy Manager, all versions, contains an overly permissive Cross-Origin Resource Policy (CORP) vulnerability. Rated
In Directus before 9.7.0, the default settings of CORS_ORIGIN and CORS_ENABLED are true. Rated critical severity (CVSS 9
A malicious website could have learned the size of a cross-origin resource that supported Range requests. Rated critical
Remote code execution in SiYuan desktop application (versions prior to 3.6.2) allows unauthenticated remote attackers to
Permissive CORS policy in ericc-ch copilot-api up to version 0.7.0 allows remote attackers to access the Token Endpoint
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today