CVE-2026-41057
Incomplete CORS Validation in WWBN AVideo API Exposes PII
Publication date: 2026-04-21
Last updated on: 2026-04-24
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 29.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects WWBN AVideo, an open source video platform, in versions 29.0 and below. The issue is due to an incomplete fix for CORS origin validation, where two separate code paths still reflect arbitrary Origin headers with credentials allowed for all /api/* endpoints.
- In plugin/API/router.php (lines 4-8), any origin is unconditionally reflected before application code runs.
- The function allowOrigin(true), called by get.json.php and set.json.php, reflects any origin with Access-Control-Allow-Credentials set to true.
As a result, an attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing sensitive user information such as personally identifiable information (PII), email addresses, admin status, and session-sensitive data.
A fix for this issue is contained in commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13.
How can this vulnerability impact me? :
This vulnerability can allow attackers to perform cross-origin credentialed requests to the API endpoints of the affected WWBN AVideo platform.
By exploiting this, attackers can read authenticated responses that include sensitive user data such as personally identifiable information (PII), email addresses, admin status, and session-sensitive data.
This can lead to unauthorized disclosure of sensitive information, potential account compromise, and unauthorized administrative access.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13.
This fix addresses the incomplete CORS origin validation that allows arbitrary Origin headers with credentials on all /api/* endpoints.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
This vulnerability allows an attacker to make cross-origin credentialed requests to API endpoints and read authenticated responses containing user personally identifiable information (PII), email, admin status, and session-sensitive data.
Exposure of such sensitive data can lead to non-compliance with data protection regulations like GDPR and HIPAA, which require strict controls over access to personal and sensitive information.