CVE-2026-41057 is a CWE-346 Origin Validation Error affecting WWBN AVideo versions 29.0 and earlier. The vulnerability arises because two code paths reflect arbitrary Origin headers with Access-Control-Allow-Credentials set to true, specifically in plugin/API/router.php and in allowOrigin(true) calls within get.json.php and set.json.php. This improper CORS configuration allows cross-origin credentialed requests to API endpoints, exposing authenticated user data including personally identifiable information and session-sensitive details. Although a corrective commit has been identified, no official patch or vendor advisory confirming remediation status is currently available.

An attacker can exploit this vulnerability to perform cross-origin requests that include user credentials and read sensitive authenticated responses. This can lead to unauthorized disclosure of user personally identifiable information, email addresses, administrative status, and session-related data. The vulnerability compromises confidentiality but does not affect integrity or availability. The CVSS score of 7.1 reflects a high severity due to the ease of exploitation and the sensitive nature of the data exposed.

A fix for this vulnerability exists in commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13. However, there is no official vendor advisory or patch release confirming deployment of this fix. Users should review and apply this commit or subsequent official patches when available. Until patched, restrict cross-origin requests to trusted origins and consider disabling credentialed CORS requests on API endpoints as a temporary mitigation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.