CVE-2026-29093 - Vulnerability Analysis

Overview

WWBN AVideo prior to 24.0 contains a broken access control vulnerability caused by unauthenticated memcached service exposure on host port 11211, letting attackers read, modify, or flush session data, enabling session hijacking and impersonation, exploit requires network access to port 11211.

Severity & Score

Impact

Attackers can hijack or impersonate admin sessions and destroy multiple sessions, leading to unauthorized access and denial of service.

Mitigation

Update to version 24.0 or later.

References

• https://github.com/WWBN/AVideo/releases/tag/24.0
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xxpw-32hf-q8v9

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 6, 2026

🟠 CVE-2026-29093 - High (8.1) WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user s... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-29093/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner