WWBN AVideo has a CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) Exposes Authenticated API Responses
Date: 2026-04
Affected: composer/wwbn/avideo
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2026-41057
CWE: CWE-346
CVSS: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N)

## Summary The CORS origin validation fix in commit `986e64aad` is incomplete. Two separate code paths still reflect arbitrary `Origin` headers with credentials allowed for all `/api/*` endpoints: (1) `plugin/API/router.php` lines 4-8 unconditionally reflect any origin before application code runs, and (2) `allowOrigin(true)` called by `get.json.php` and `set.json.php` reflects any origin with `Access-Control-Allow-Credentials: true`. An attacker can make cross-origin credentialed requests to any API endpoint and read authenticated responses containing user PII, email, admin status, and session-sensitive data. ## Details ### Bypass Vector 1: router.php independent CORS handler `plugin/API/router.php:4-8` runs before any application code: ```php // plugin/API/router.php lines 4-8 $HTTP_ORIGIN = empty($_SERVER['HTTP_ORIGIN']) ? @$_SERVER['HTTP_REFERER'] : $_SERVER['HTTP_ORIGIN']; if (empty($HTTP_ORIGIN)) { header('Access-Control-Allow-Origin: *'); } else { header("Access-Control-Allow-Origin: " . $HTTP_ORIGIN); } ``` This reflects **any** `Origin` header verbatim. For OPTIONS preflight requests (lines 14-18), the script exits immediately — the fixed `allowOrigin()` function never executes: ```php // plugin/API/router.php lines 14-18 if ($_SERVER['REQUEST_METHOD'] === 'OPTIONS') { header("Access-Control-Max-Age: 86400"); http_response_code(200); exit; } ``` All `/api/*` requests are routed through this file via `.htaccess` rules (lines 131-132). ###


Mitigations:

Architectural layers (MAESTRO):