Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-41056AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enables Cross-Origin Account Takeover

High 8.1

In plain English

A high-severity security flaw in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any arbitrary `Origin` header back in `Access-Control-Allow-Origin` along with `Access-Control-Allow-Credentials: true`. This function is called by both `plugin/API/get.json.php` and `plugin/API/set.json.php` — the primary API endpoints that handle user data retrieval, authentication, livestream credentials, and state-changing operations. Combined with the application's `SameSite=None` session cookie policy, any website can make credentialed cross-origin requests and read authenticated API responses, enabling theft of user PII, livestream keys, and performing state changes on behalf of the victim. Commit caf705f38eae0ccfac4c3af1587781355d24495e contains a fix.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-ccq9-r5cw-5hwq

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 29.0

Weakness: CWE-942 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-ccq9-r5cw-5hwq x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/caf705f38eae0ccfac4c3af1587781355d24495e x_refsource_MISC