What is the CVSS score of CVE-2026-41057?

CVE-2026-41057 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-41057?

WWBN AVideo 29.0 and earlier contains a cross-origin data exposure vulnerability (CVE-2026-41057) that allows attackers to steal authenticated API responses-including user emails, admin status, and…

How to fix or mitigate CVE-2026-41057?

Within 24 hours: Inventory all AVideo deployments and assess which users have admin roles or elevated privileges whose data could be exfiltrated; communicate a security advisory to end-users warning against visiting untrusted websites while using AVideo. Within 7 days: Deploy WAF rules or reverse-proxy controls to add X-Frame-Options, Strict-Transport-Security, and Content-Security-Policy headers on API responses; disable unnecessary CORS headers if feasible, and consider temporarily restricting AVideo API access to trusted networks if operationally viable. Within 30 days: Contact WWBN for patch timeline and upgrade guidance, evaluate upgrading to patched releases when available, and implement endpoint detection monitoring for suspicious API activity patterns.

WWBN AVideo CVE-2026-41057

HIGH

Origin Validation Error (CWE-346)

2026-04-21 security-advisories@github.com

GHSA-ff5q-cc22-fgp4

PHP Information Disclosure Avideo Wwbn

7.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

vuln.today AI

7.1 HIGH

Remote, low-complexity CORS reflection needs no attacker auth (PR:N) but a logged-in victim must visit a malicious page (UI:R); high PII disclosure (C:H), limited cross-origin writes via set.json.php (I:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:26 vuln.today

Analysis Generated

Jul 24, 2026 - 05:26 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 7.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit 986e64aad is incomplete. Two separate code paths still reflect arbitrary Origin headers with credentials allowed for all /api/* endpoints: (1) plugin/API/router.php lines 4-8 unconditionally reflect any origin before application code runs, and (2) allowOrigin(true) called by get.json.php and set.json.php reflects any origin with Access-Control-Allow-Credentials: true. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. Commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 contains a fix.

AnalysisAI

Cross-origin data exposure in WWBN AVideo 29.0 and earlier lets a malicious website read authenticated /api/* responses because an incomplete CORS fix still reflects arbitrary Origin headers with Access-Control-Allow-Credentials: true. Any logged-in user who visits an attacker-controlled page can have their session-authenticated API responses - containing email, admin status, user ID, and other PII - read cross-origin. Publicly available exploit code exists (SSVC: poc) and the issue is confirmed via GitHub Security Advisory GHSA-ff5q-cc22-fgp4, though EPSS is very low (0.01%) and it is not in CISA KEV.

Technical ContextAI

AVideo is a PHP-based open-source video streaming/hosting platform (cpe:2.3:a:wwbn:avideo). The flaw is a CWE-346 Origin Validation Error in its CORS implementation. Browsers enforce the same-origin policy, but servers can opt into cross-origin sharing via Access-Control-Allow-Origin; reflecting the caller's Origin verbatim while also sending Access-Control-Allow-Credentials: true effectively disables that protection, allowing any site to make credentialed (cookie-bearing) requests and read the responses. Two code paths are affected: plugin/API/router.php (lines 4-8) unconditionally reflects any Origin/Referer before application logic runs and short-circuits OPTIONS preflights, and objects/functions.php allowOrigin(true) - invoked by get.json.php and set.json.php - reflects the origin with credentials on the $allowAll code path that the prior fix (commit 986e64aad) never touched. Because session cookies ride along, User::isLogged() returns true and sensitive fields that are normally stripped for anonymous callers are returned.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - apply the changes from commit https://github.com/WWBN/AVideo/commit/5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13, which returns Access-Control-Allow-Origin: * without credentials for OPTIONS preflights and hardens the allowOrigin(true) path so credentials are only granted to same-origin requests, per advisory https://github.com/WWBN/AVideo/security/advisories/GHSA-ff5q-cc22-fgp4. Because no tagged release is confirmed, track the vendor for a versioned build or deploy the patched source directly. As compensating controls until patched: at a reverse proxy or WAF, strip or overwrite the Access-Control-Allow-Origin and Access-Control-Allow-Credentials response headers on /api/* so arbitrary origins are not reflected (side effect: legitimate browser-based cross-origin API integrations will break and must be explicitly allowlisted); alternatively restrict /api/* to trusted networks or require the non-credentialed APISecret flow for external clients (side effect: cookie-session-based front-end API calls from other origins stop working). Advising users to log out of admin sessions when browsing untrusted sites reduces exposure but is not a reliable control.