The vulnerability lies in allowing unauthenticated access to a memcached instance that stores PHP session data. An attacker who can reach the exposed port can read, modify, or delete session entries, enabling hijacking of authenticated users and impersonation of administrators without any application‑level authentication. This results in potential compromise of confidentiality, integrity, and availability of all active sessions.

Any installation of WWBN AVideo using the official Docker image prior to version 24.0 where the default docker‑compose configuration publishes port 11211 to the host and no authentication is required for memcached. Systems relying on Docker or similar setups that expose the memcached service externally are directly affected.

The CVSS score of 8.1 categorises this as a high‑severity flaw, and the low EPSS value (<1%) indicates a small current exploitation probability; however, the impact of a single exercise is significant. The flaw is not in the CISA KEV catalogue. Exploitation requires simple interaction with the memcached protocol over a publicly reachable port, typically via a machine on the same network or with direct external access. Successful exploitation yields full session control, allowing attackers to impersonate users, elevate privileges to admin, or perform mass session invalidation. No specific privileges are required beyond network connectivity to the port.