Cross-Origin Resource Sharing Flaw in WWBN AVideo Affects User Data Security
CVE-2026-41056

8.1HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
21 April 2026

What is CVE-2026-41056?

The AVideo platform, an open source video streaming service, is vulnerable to a CORS flaw in versions 29.0 and earlier, where the function allowOrigin($allowAll=true) improperly reflects any arbitrary Origin header. This misconfiguration allows external websites to initiate credentialed cross-origin requests, potentially exposing sensitive user data such as personally identifiable information (PII) and livestream credentials. This vulnerability arises from the improper handling of session cookies with a SameSite=None policy, which, when combined with the reflective vulnerability, can allow attackers to manipulate API endpoints for unauthorized actions. A patch has been implemented in commit caf705f38eae0ccfac4c3af1587781355d24495e to address these issues.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-c...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/caf705f38eae0ccfac4...
x_refsource_MISC

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.