Most recent entries from all

EUVD-2026-292626

2026-10-09T08:01:24.997874+00:00

EUVD-2026-292626

fkie_cve-2026-41057

2026-10-09T08:01:24.997915+00:00

WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. Commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 contains a fix.

GHSA-ff5q-cc22-fgp4 — WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated A…

2026-10-09T08:01:24.997951+00:00

Affected: Packagist: wwbn/avideo

## Summary

The CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data.

## Details

### Bypass Vector 1: router.php independent CORS handler

`plugin/API/router.php:4-8` runs before any application code:

```php // plugin/API/router.php lines 4-8 $HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_SERVER['HTTP_ORIGIN']; if (empty($HTTP_ORIGIN)) { header('Access-Control-Allow-Origin: *'); } else { header("Access-Control-Allow-Origin: " . $HTTP_ORIGIN); } ```

This reflects **any** `Origin` header verbatim. For OPTIONS preflight requests (lines 14-18), the script exits immediately — the fixed `allowOrigin()` function never executes:

```php // plugin/API/router.php lines 14-18 if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { header("Access-Control-Max-Age: 86400"); http_response_code(200); exit; } ```

All `/api/*` requests are routed through this file via `.htaccess` rules (lines 131-132).

###…