CVE-2026-41056

WWBN AVideo is an open source video platform. In versions 29.0 and below, the "allowOrigin$allowAll=true" function in "objects/functions.php" reflects any arbitrary "Origin" header back in "Access-Control-Allow-Origin" along with "Access-Control-Allow-Credentials: true". This function is called b...