The vulnerability in WWBN AVideo (<=29.0) arises from the allowOrigin($allowAll=true) function in objects/functions.php, which reflects any Origin header back in Access-Control-Allow-Origin and sets Access-Control-Allow-Credentials to true. This insecure CORS policy is applied on primary API endpoints (plugin/API/get.json.php and plugin/API/set.json.php) that manage sensitive user data and authentication. Because the application uses SameSite=None cookies, malicious websites can make credentialed cross-origin requests and read authenticated responses, leading to theft of personally identifiable information, livestream credentials, and unauthorized state changes. A code commit (caf705f38eae0ccfac4c3af1587781355d24495e) contains a fix, but no official patch or vendor advisory is documented.

Exploitation allows attackers to perform cross-origin requests with user credentials, bypassing same-origin protections. This can lead to disclosure of sensitive user information including PII and livestream keys, and unauthorized modification of user state via API calls. The vulnerability has a CVSS score of 8.1 (high severity) indicating a significant risk to confidentiality and integrity, but no impact on availability. No known exploits in the wild are reported.

A code fix addressing this vulnerability exists in commit caf705f38eae0ccfac4c3af1587781355d24495e. However, no official patch release or vendor advisory is currently available. Users should monitor the WWBN project for an official update and apply the fix promptly once released. Until then, consider restricting API access or implementing additional access controls to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.