CVE-2026-41057
Received Received - Intake
Incomplete CORS Validation in WWBN AVideo API Exposes PII

Publication date: 2026-04-21

Last updated on: 2026-04-24

Assigner: GitHub, Inc.

Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. Commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 contains a fix.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-21
Last Modified
2026-04-24
Generated
2026-05-07
AI Q&A
2026-04-22
EPSS Evaluated
2026-05-05
NVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wwbn avideo to 29.0 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-346 The product does not properly verify that the source of data or communication is valid.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability affects WWBN AVideo, an open source video platform, in versions 29.0 and below. The issue is due to an incomplete fix for CORS origin validation, where two separate code paths still reflect arbitrary Origin headers with credentials allowed for all /api/* endpoints.

  • In plugin/API/router.php (lines 4-8), any origin is unconditionally reflected before application code runs.
  • The function allowOrigin(true), called by get.json.php and set.json.php, reflects any origin with Access-Control-Allow-Credentials set to true.

As a result, an attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing sensitive user information such as personally identifiable information (PII), email addresses, admin status, and session-sensitive data.

A fix for this issue is contained in commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13.


How can this vulnerability impact me? :

This vulnerability can allow attackers to perform cross-origin credentialed requests to the API endpoints of the affected WWBN AVideo platform.

By exploiting this, attackers can read authenticated responses that include sensitive user data such as personally identifiable information (PII), email addresses, admin status, and session-sensitive data.

This can lead to unauthorized disclosure of sensitive information, potential account compromise, and unauthorized administrative access.


What immediate steps should I take to mitigate this vulnerability?

To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13.

This fix addresses the incomplete CORS origin validation that allows arbitrary Origin headers with credentials on all /api/* endpoints.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

This vulnerability allows an attacker to make cross-origin credentialed requests to API endpoints and read authenticated responses containing user personally identifiable information (PII), email, admin status, and session-sensitive data.

Exposure of such sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart