Attack Chain

1. Attacker identifies an AVideo instance running version 29.0 or below.
2. Attacker crafts a malicious webpage containing JavaScript code designed to make cross-origin requests to the vulnerable AVideo instance's /api/* endpoints.
3. The malicious webpage sets the Origin header to an arbitrary value.
4. Due to the incomplete CORS validation in plugin/API/router.php, the server reflects the arbitrary origin.
5. Alternatively, the malicious webpage triggers get.json.php or set.json.php, which call allowOrigin(true) and reflect the arbitrary origin with Access-Control-Allow-Credentials: true.
6. The attacker's JavaScript code sends a credentialed request (e.g., including cookies) to the /api/* endpoint.
7. The AVideo server processes the request and returns an authenticated response containing user PII, email, admin status, and session-sensitive data.
8. The attacker's malicious webpage extracts and exfiltrates the sensitive data from the response.

Impact

Successful exploitation of CVE-2026-41057 allows attackers to bypass CORS restrictions and access sensitive information from vulnerable AVideo instances. This includes user PII, email addresses, admin status, and session-sensitive data. The impact could range from unauthorized access to user accounts to complete compromise of the AVideo platform, depending on the specific API endpoint targeted and the permissions of the compromised user. The number of victims is dependent on the number of vulnerable AVideo instances exposed to the internet.

Recommendation

• Apply the patch from commit 5e2b897ccac61eb6daca2dee4a6be3c4c2d93e13 to remediate CVE-2026-41057.
• Deploy the Sigma rules provided to detect attempts to exploit this CORS vulnerability within web server logs.
• Monitor web server logs for requests to /api/* endpoints with unusual or unexpected Origin headers.
• Implement proper CORS validation on all AVideo instances, ensuring that only trusted origins are allowed to access sensitive API endpoints.