CVE-2026-41057

WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit "986e64aad" is incomplete. Two separate code paths still reflect arbitrary "Origin" headers with credentials allowed for all "/api/" endpoints: 1 "plugin/API/router.php" lines 4-8...

CVE-2026-41056

WWBN AVideo is an open source video platform. In versions 29.0 and below, the "allowOrigin$allowAll=true" function in "objects/functions.php" reflects any arbitrary "Origin" header back in "Access-Control-Allow-Origin" along with "Access-Control-Allow-Credentials: true". This function is called b...

CVE-2026-41057: Origin Validation Error

WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit 986e64aad is incomplete. Two separate code paths still reflect arbitrary Origin headers with credentials allowed for all /api/ endpoints: 1 plugin/API/router.php lines 4-8...

PT-2026-35108

Summary The allowOrigin$allowAll=true function in objects/functions.php reflects any arbitrary Origin header back in Access-Control-Allow-Origin along with Access-Control-Allow-Credentials: true. This function is called by both plugin/API/get.json.php and plugin/API/set.json.php — the primary API...