WWBN AVideo CVE-2026-41057

Exploitation requires a victim who is actively authenticated to the target AVideo instance (holds a valid session cookie) and who is induced to visit an attacker-controlled web page - that user interaction (UI:R) is the primary gating condition, so this cannot be triggered server-to-server without a victim browser. No special AVideo configuration is needed: the affected code paths (plugin/API/router.php reflection and allowOrigin(true) in get.json.php/set.json.php) are present by default in versions <= 29.0, and any /api/* endpoint routed through .htaccess is exposed. What limits exploitation: the attacker cannot authenticate on their own (they piggyback on the victim's session), the victim must be logged in at exploitation time, and the instance must be reachable by the victim's browser; the amount of data returned depends on the victim's privilege level (an admin victim yields the most sensitive disclosure).

Signals are consistent and point to a moderate, opportunistic-but-not-mass risk. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N, base 7.1) reflects network reach and low complexity but critically requires user interaction - a logged-in victim must visit an attacker page - which caps automatability, matching SSVC (Exploitation: poc, Automatable: no, Technical Impact: partial). EPSS is 0.01% (3rd percentile) and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation despite POC availability; POC existence and active exploitation are distinct and should not be conflated. Confidentiality impact is genuine (PII/admin-status disclosure) with limited integrity impact via set.json.php writes and no availability impact. Net: a real, worth-patching information-disclosure issue for any internet-exposed AVideo instance with authenticated users, but not an emergency drop-everything item - the UI:R requirement and lack of automatability make it targeted rather than wormable.

An attacker hosts a malicious web page and lures a logged-in AVideo user (e.g., an admin) to visit it while their session cookie is active. The page issues a credentialed fetch() to the victim's AVideo /api/ endpoints; because the server reflects the attacker's Origin with Access-Control-Allow-Credentials: true, the attacker's JavaScript can read the authenticated JSON responses and exfiltrate the victim's email, user ID, and admin status. The attack is low-complexity (AC:L) and requires only that the victim open the page (UI:R); POC-level exploitation is reported.