Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.1

AVideo API lets attackers read user data across sites

CVE-2026-41057 · published 6 months ago
Summary

Versions of the open-source AVideo platform up to 29.0 accept requests from any other website and then return private user information, such as email addresses and admin status, even when the request includes login credentials. This means a malicious site could silently collect that data from logged-in users. Upgrade to the version that includes the fix or apply the posted patch to stop the unwanted data sharing.

Original advisory text
WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin...
WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. Commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 contains a fix.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
7.1 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-346Origin Validation Error
Timeline
Published21 Apr 2026
Updated26 Oct 2026
First seen21 Apr 2026
Sources
CVE-2026-41057 · NVD
Track software like this
Free during beta