The flaw resides in an incomplete CORS origin validation in AVideo versions 29.0 and earlier, where the script unconditionally reflects any Origin header and sets the Access‑Control‑Allow‑Credentials flag for all /api/* endpoints. This constitutes a CWE‑346 origin‑validation weakness that enables a malicious site to issue cross‑origin, credentialed requests on the victim’s behalf and read the resulting API responses, which can contain personally identifiable information, email addresses, administrative status, and other session‑sensitive data. The primary security impact is the confidential disclosure of authenticated user information.

The affected product is the open‑source AVideo platform developed by WWBN. Versions 29.0 and all earlier releases are impacted. No other vendors or product variants are listed in the advisory.

The CVSS score of 7.1 indicates high severity. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is a standard web request that an attacker can trigger by hosting a malicious page; no special privileges are required other than the victim’s credentials being present in their browser. Exploitation involves sending a cross‑origin request to any /api/* endpoint with credentials enabled, receiving the reflected Origin header with Access‑Control‑Allow‑Credentials, and reading the authenticated response.