A critical cross-domain policy vulnerability in WWBN AVideo exposes user data and API functionality to unauthorized cross-origin requests, risking full account compromise.

The application utilizes a permissive cross-domain policy in the allowOrigin function, which reflects arbitrary Origin headers with credentials enabled. This allows unauthenticated attackers to execute unauthorized API requests on behalf of authenticated users by leveraging the application's SameSite=None cookie policy.

The exploitation of this flaw enables attackers to steal sensitive user information, exfiltrate livestream credentials, and perform state-changing operations within the platform. With a CVSS score of 8.1, the vulnerability represents a high risk to data confidentiality and integrity, potentially leading to widespread unauthorized access and significant reputational damage.

Immediate Action: Since an official patched version is currently unavailable, administrators should apply the fix provided in commit caf705f38eae0ccfac4c3af1587781355d24495e directly to their source environment.

Proactive Monitoring: Review web server logs for suspicious cross-origin requests originating from unknown domains, specifically targeting the API endpoints at plugin/API/get.json.php and plugin/API/set.json.php.

Compensating Controls: Implement strict CORS policies at the Web Application Firewall (WAF) or reverse proxy layer to explicitly whitelist trusted domains and drop requests with unauthorized Origin headers.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for total account takeover via cross-origin request forgery, organizations hosting AVideo must prioritize the manual application of the provided code fix. Until a formal vendor release is available, strict WAF filtering is the most effective measure to prevent unauthorized access to sensitive API functions and user session data.