The vulnerability lies in the function that reflects any supplied Origin header to the Access‑Control‑Allow‑Origin response while also enabling credentials for both data retrieval and state‑changing API endpoints. This flaw permits a malicious web site to issue cross‑origin, authenticated requests and read protected responses, resulting in theft of personal user information, livestream keys, and the ability to modify user state. The weakness maps to CWE‑942, reflecting a misuse of CORS.

The affected application is the WWBN AVideo open‑source video platform. Versions 29.0 and earlier contain the vulnerable implementation in objects/functions.php, plugin/API/get.json.php, and plugin/API/set.json.php. No other vendors or products are listed as affected.

With a CVSS score of 8.1, this vulnerability is considered high severity. The EPSS score is not provided, but the lack of KEV listing does not diminish the risk; attackers can exploit the flaw from any arbitrary web page by simply setting the Origin header and using the Server‑side SameSite=None session cookie policy to carry credentials. The attack requires only a web browser and the ability to target the victim’s device, making exploitation straightforward for determined adversaries.