https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 09 Oct 2026 11:44:50 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-292626 EUVD-2026-292626 https://cve.radiocsirt.org/vuln/euvd-2026-292626 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41057 <p>WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. Commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 contains a fix.</p> <p>WWBN AVideo is an open source video platform. In versions 29.0 and below, the CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. Commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 contains a fix.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41057 https://cve.radiocsirt.org/vuln/ghsa-ff5q-cc22-fgp4 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data.</p> <p>## Details</p> <p>### Bypass Vector 1: router.php independent CORS handler</p> <p>`plugin/API/router.php:4-8` runs before any application code:</p> <p>```php // plugin/API/router.php lines 4-8 $HTTP_ORIGIN = empty($_SERVER[&#39;HTTP_ORIGIN&#39;]) ? @$_SERVER[&#39;HTTP_REFERER&#39;] : $_SERVER[&#39;HTTP_ORIGIN&#39;]; if (empty($HTTP_ORIGIN)) { header(&#39;Access-Control-Allow-Origin: *&#39;); } else { header(&#34;Access-Control-Allow-Origin: &#34; . $HTTP_ORIGIN); } ```</p> <p>This reflects **any** `Origin` header verbatim. For OPTIONS preflight requests (lines 14-18), the script exits immediately — the fixed `allowOrigin()` function never executes:</p> <p>```php // plugin/API/router.php lines 14-18 if ($_SERVER[&#39;REQUEST_METHOD&#39;] === &#39;OPTIONS&#39;) { header(&#34;Access-Control-Max-Age: 86400&#34;); http_response_code(200); exit; } ```</p> <p>All `/api/*` requests are routed through this file via `.htaccess` rules (lines 131-132).</p> <p>###…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>## Summary</p> <p>The CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data.</p> <p>## Details</p> <p>### Bypass Vector 1: router.php independent CORS handler</p> <p>`plugin/API/router.php:4-8` runs before any application code:</p> <p>```php // plugin/API/router.php lines 4-8 $HTTP_ORIGIN = empty($_SERVER[&#39;HTTP_ORIGIN&#39;]) ? @$_SERVER[&#39;HTTP_REFERER&#39;] : $_SERVER[&#39;HTTP_ORIGIN&#39;]; if (empty($HTTP_ORIGIN)) { header(&#39;Access-Control-Allow-Origin: *&#39;); } else { header(&#34;Access-Control-Allow-Origin: &#34; . $HTTP_ORIGIN); } ```</p> <p>This reflects **any** `Origin` header verbatim. For OPTIONS preflight requests (lines 14-18), the script exits immediately — the fixed `allowOrigin()` function never executes:</p> <p>```php // plugin/API/router.php lines 14-18 if ($_SERVER[&#39;REQUEST_METHOD&#39;] === &#39;OPTIONS&#39;) { header(&#34;Access-Control-Max-Age: 86400&#34;); http_response_code(200); exit; } ```</p> <p>All `/api/*` requests are routed through this file via `.htaccess` rules (lines 131-132).</p> <p>###…</p> https://cve.radiocsirt.org/vuln/ghsa-ff5q-cc22-fgp4