WWBN AVideo CVE-2026-41056

Exploitation requires that the victim be actively logged into the target AVideo instance AND that the victim's browser visit an attacker-controlled web page (UI:R) while that session is valid; the API must be reachable and the deployment must retain the default SameSite=None session cookie (objects/include_config.php:144) so credentials are sent cross-origin. No attacker-side authentication or privileges are needed (PR:N). Limiting factors: it fails entirely if the user is not logged in, if the browser or a proxy strips third-party credentialed CORS, or if the cookie policy has been hardened to Lax/Strict; it is not automatable at scale (SSVC automatable: no) because each compromise depends on socially engineering a specific authenticated victim.

Signals are moderately consistent but point to a real-but-not-urgent web-client vulnerability rather than a mass-exploited one. CVSS 3.1 is 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N): network reachable, low complexity, no attacker privileges, but user interaction is required - the victim must be logged in and must visit an attacker-controlled page, which meaningfully limits scale. SSVC classifies exploitation as 'poc', automatable 'no', and technical impact 'total', aligning with the high C/I but confirming it is not turn-key automatable. EPSS is only 0.04% (13th percentile) and there is no KEV listing, so widespread opportunistic exploitation is unlikely; risk is highest for high-value AVideo instances where stream keys or admin accounts are worth targeting. Note the confidentiality/integrity impact hinges on the victim being authenticated - an unauthenticated victim yields nothing - so real-world impact is bounded by luring active, logged-in users.

An attacker hosts a malicious page and lures a logged-in AVideo user to visit it; the page issues a credentialed fetch to the target's get.json.php get_api_user endpoint, and because the reflected-origin-with-credentials CORS response permits it, JavaScript reads the victim's PII, admin flags, and livestream server password/stream key. The attacker can then call set.json.php to perform state changes as the victim. A proof-of-concept is described in the GHSA advisory, and the low CVSS complexity (AC:L) means the only real hurdle is getting an authenticated victim to open the page (UI:R).