PT-2026-34202 · Avideo · Avideo

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-41056

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 29.0 and earlier

Description The allowOrigin($allowAll=true) function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is utilized by the API endpoints 'plugin/API/get.json.php' and 'plugin/API/set.json.php', which manage user data retrieval, authentication, livestream credentials, and state-changing operations. Due to the application using a SameSite=None session cookie policy, external websites can perform credentialed cross-origin requests to read authenticated API responses. This can lead to the theft of personally identifiable information (PII), livestream keys, and unauthorized state changes on behalf of the victim.

Recommendations Update to a version containing commit caf705f38eae0ccfac4c3af1587781355d24495e. As a temporary workaround, restrict access to the 'plugin/API/get.json.php' and 'plugin/API/set.json.php' endpoints or disable the allowOrigin() function until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-942

Related Identifiers

CVE-2026-41056

GHSA-CCQ9-R5CW-5HWQ

Affected Products

Avideo

References · 7

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-ccq9-r5cw-5hwq · Exploit
• https://github.com/WWBN/AVideo/commit/caf705f38eae0ccfac4c3af1587781355d24495e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41056 · Security Note
• https://osv.dev/vulnerability/GHSA-ccq9-r5cw-5hwq · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2046886748781752567 · Twitter Post
• https://twitter.com/CVEnew/status/2048481070207607286 · Twitter Post