CVE-2026-41056
Wwbn Avideo ≤ 29.0
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:NSummary
CVE-2026-41056 is a high-severity Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) vulnerability in Wwbn Avideo. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 26th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SC-7 (Boundary Protection) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-41056 is a cross-origin resource sharing (CORS) misconfiguration vulnerability affecting WWBN AVideo, an open source video platform, in versions 29.0 and below. The issue resides in the `allowOrigin($allowAll=true)` function within `objects/functions.php`, which indiscriminately reflects any arbitrary `Origin` header value back in the `Access-Control-Allow-Origin` response header while also setting `Access-Control-Allow-Credentials: true`. This function is invoked by key API endpoints, including `plugin/API/get.json.php` and `plugin/API/set.json.php`, which manage user data retrieval, authentication, livestream credentials, and state-changing operations. The vulnerability is rated with a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and is associated with CWE-942 (Permissive Cross-domain Policy with Untrusted Domains).
An attacker can exploit this vulnerability by hosting a malicious website that tricks an authenticated user into visiting it, leveraging the application's `SameSite=None` session cookie policy. This enables the attacker's site to perform credentialed cross-origin requests to the AVideo instance, reading sensitive authenticated API responses. Potential impacts include theft of user personally identifiable information (PII), livestream keys, and execution of state-changing operations on behalf of the victim, such as modifying user data or other administrative actions.
Mitigation is available via a patch in commit caf705f38eae0ccfac4c3af1587781355d24495e on the WWBN/AVideo GitHub repository. The GitHub Security Advisory GHSA-ccq9-r5cw-5hwq provides further details on the issue and recommends upgrading to a patched version to enforce proper origin validation and restrict cross-origin access.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-24531
Vulnerability Data
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `allowOrigin($allowAll=true)` function in `objects/functions.php` reflects any arbitrary `Origin` header back in `Access-Control-Allow-Origin` along with `Access-Control-Allow-Credentials: true`. This function is called by both `plugin/API/get.json.php` and `plugin/API/set.json.php` —…
more
the primary API endpoints that handle user data retrieval, authentication, livestream credentials, and state-changing operations. Combined with the application's `SameSite=None` session cookie policy, any website can make credentialed cross-origin requests and read authenticated API responses, enabling theft of user PII, livestream keys, and performing state changes on behalf of the victim. Commit caf705f38eae0ccfac4c3af1587781355d24495e contains a fix.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.4.3V3.4.6V3.5.2
Mitigating Controls (NIST 800-53 r5) AI
Information flow enforcement requires approved authorizations and would reject policies permitting untrusted domains.
Boundary protection at external interfaces stops unauthorized cross-domain communication allowed by permissive policies.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Hardened configuration baselines and reviews directly prevent permissive CSP or cross-domain policies.
Secure SDLC activities include review and testing of web security policies to avoid untrusted domains.
Vulnerability identification processes can surface permissive policy misconfigurations.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect overly permissive cross-domain policies but does not prevent their initial introduction.
Network security policies can restrict cross-domain communication but do not specifically mandate strict CSP or cross-domain policy configuration.
Security of network services includes defining allowed endpoints, which can limit untrusted domains but does not directly address web-client policy files.
Web filtering can block untrusted domains at the network level, partially mitigating permissive cross-domain policies.
Application security requirements should specify secure CSP and cross-domain policy settings, directly addressing the weakness.
Secure architecture principles include defining trust boundaries, which can reduce permissive cross-domain allowances.