CVE-2026-29093Disclosure(wwbn / avideo)

LOWCVSS 9.8 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.

wwbn CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Exploit / PoC references

https://github.com/WWBN/AVideo/security/advisories/GHSA-xxpw-32hf-q8v9

Other references

https://github.com/WWBN/AVideo/releases/tag/24.0

Weakness type (CWE)

CWE-287CWE-668

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

avideo

Threat summary

6 mentions across 4 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 3 classified signals
General: 3 classified signals
Peaked 3d ago at 3 mentions (2026-03-06); latest day: 1
6 total mentions across 4 days

Affected systems

Vendors

wwbn

Products

avideo

Deep dive

Activity timeline6 mentions / 4d

Signal classification2 categories

Disclosure

350.0%

General

350.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-06	3	Disclosure3
2026-03-11	1	General1
2026-05-14	1	General1
2026-08-27	1	General1

Full discourse6 posts

BugBunny.ai - Continuous AI Pentesting System@BugBunny_ai148d
General
66 CVE-2025-58434 CVE-2025-59057 CVE-2025-59790 CVE-2025-59792 CVE-2025-61622 CVE-2025-61686 CVE-2025-64756 CVE-2026-21884 CVE-2026-22807 CVE-2026-23630 CVE-2026-27471 CVE-2026-27806 CVE-2026-27955 CVE-2026-28215 CVE-2026-28217 CVE-2026-28351 CVE-2026-28361 CVE-2026-28384 CVE-2026-28396 CVE-2026-28398 CVE-2026-28444 CVE-2026-28445 CVE-2026-29093 CVE-2026-30973 CVE-2026-31888 CVE-2026-33016 CVE-2026-33037 CVE-2026-33038 CVE-2026-33039 CVE-2026-3351 CVE-2026-34037 CVE-2026-34158 CVE-2026-34167 CVE-2026-34170 CVE-2026-34171 CVE-2026-34198 CVE-2026-34532 CVE-2026-34573 CVE-2026-34574 CVE-2026-34595 CVE-2026-34746 CVE-2026-34748 CVE-2026-34749 CVE-2026-34750 CVE-2026-34972 CVE-2026-35214 CVE-2026-35412 CVE-2026-35413 CVE-2026-35441 CVE-2026-40165 CVE-2026-40293 CVE-2026-40302 CVE-2026-40304 CVE-2026-40454 CVE-2026-40914 CVE-2026-41131 CVE-2026-41590 CVE-2026-42883 CVE-2026-42884 CVE-2026-42885 CVE-2026-42886 CVE-2026-43888 CVE-2026-43889 CVE-2026-43998 CVE-2026-43999 CVE-2026-4800
Post summary
The content consists solely of a list of CVE identifiers without additional context or actionable information.
2176862729382.1K
3.1K followersView on X
BugBunny.ai - Continuous AI Pentesting System@BugBunny_ai43d
General
108 CVE-2025-58434 CVE-2025-59057 CVE-2025-59343 CVE-2025-59790 CVE-2025-59792 CVE-2025-61622 CVE-2025-61686 CVE-2025-62228 CVE-2025-62232 CVE-2025-64756 CVE-2026-21884 CVE-2026-22706 CVE-2026-22807 CVE-2026-23630 CVE-2026-24015 CVE-2026-24899 CVE-2026-27471 CVE-2026-27806 CVE-2026-27955 CVE-2026-28215 CVE-2026-28217 CVE-2026-28351 CVE-2026-28361 CVE-2026-28384 CVE-2026-28396 CVE-2026-28398 CVE-2026-28444 CVE-2026-28445 CVE-2026-29093 CVE-2026-30973 CVE-2026-31888 CVE-2026-33016 CVE-2026-33037 CVE-2026-33038 CVE-2026-33039 CVE-2026-33264 CVE-2026-33413 CVE-2026-3351 CVE-2026-34037 CVE-2026-34158 CVE-2026-34167 CVE-2026-34170 CVE-2026-34171 CVE-2026-34198 CVE-2026-34532 CVE-2026-34573 CVE-2026-34574 CVE-2026-34595 CVE-2026-34746 CVE-2026-34748 CVE-2026-34749 CVE-2026-34750 CVE-2026-34972 CVE-2026-35214 CVE-2026-35412 CVE-2026-35413 CVE-2026-35441 CVE-2026-40006 CVE-2026-40007 CVE-2026-40009 CVE-2026-40165 CVE-2026-40293 CVE-2026-40302 CVE-2026-40304 CVE-2026-40452 CVE-2026-40454 CVE-2026-40914 CVE-2026-41131 CVE-2026-41590 CVE-2026-42275 CVE-2026-42883 CVE-2026-42884 CVE-2026-42885 CVE-2026-42886 CVE-2026-43888 CVE-2026-43889 CVE-2026-43998 CVE-2026-43999 CVE-2026-44247 CVE-2026-44309 CVE-2026-44310 CVE-2026-44442 CVE-2026-44446 CVE-2026-44705 CVE-2026-44947 CVE-2026-45022 CVE-2026-45090 CVE-2026-45720 CVE-2026-45723 CVE-2026-45726 CVE-2026-46553 CVE-2026-46554 CVE-2026-47733 CVE-2026-4800 CVE-2026-48978 CVE-2026-49478 CVE-2026-50285 CVE-2026-52808 CVE-2026-52809 CVE-2026-53926 CVE-2026-53928 CVE-2026-53929 CVE-2026-53930 CVE-2026-56842 CVE-2026-60076 CVE-2026-60077 CVE-2026-75605 CVE-2026-9103
Post summary
The content lists numerous CVE identifiers without providing context, details, or actionable information.
30124138.4K
4.0K followersView on X
CRAC Learning - Tech@cracbot212d
General
CVE-2026-29093 (CVSS:8.1, HIGH) is Undergoing Analysis. WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memca..https://nvd.nist.gov/vuln/detail/CVE-2026-29093 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre
Post summary
The post announces CVE-2026-29093 with a CVSS of 8.1, but offers no PoC, exploit details, or patch information, merely noting the vulnerability is under analysis.
0000021
172 followersView on X
CVE@CVEnew216d
Disclosure
CVE-2026-29093 WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211… https://www.cve.org/CVERecord?id=CVE-2026-29093
Post summary
The vulnerability description reveals that before version 24.0, WWBN AVideo's official Docker compose exposes a memcached service on all interfaces (port 11211), potentially allowing unauthenticated access.
00000143
56.6K followersView on X
The Hacker Wire@TheHackerWire217d
Disclosure
🟠 CVE-2026-29093 - High WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication,... https://www.thehackerwire.com/vulnerability/CVE-2026-29093/ https://t.co/YqjQloMHkV
Post summary
The tweet announces CVE-2026-29093, noting that WWBN AVideo’s Docker setup exposes memcached on port 11211 without authentication, and links to a vulnerability report.
0000041
125 followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash217d
Disclosure
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-29093 - WWBN AVideo: Unauthenticated PHP session store exposed to host network via published memcached port Intel Report: https://ift.tt/DgvUHEp
Post summary
The post announces CVE-2026-29093, noting an unauthenticated PHP session store exposed through a memcached port, but provides no PoC, exploit, patch, or evidence of ongoing attacks.
0000044
343 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	wwbn	avideo	-	-	-

Explore more

Back to dashboard wwbn CVEs avideo vulnerabilities

What researchers are saying

CVE-2026-29093

BugBunny.ai - Continuous AI Pentesting System[verified]@BugBunny_aiGeneral

The content consists solely of a list of CVE identifiers without additional context or actionable information.

BugBunny.ai - Continuous AI Pentesting System@BugBunny_aiGeneral

The content lists numerous CVE identifiers without providing context, details, or actionable information.

CRAC Learning - Tech@cracbotGeneral

The post announces CVE-2026-29093 with a CVSS of 8.1, but offers no PoC, exploit details, or patch information, merely noting the vulnerability is under analysis.

CVE@CVEnewDisclosure

The vulnerability description reveals that before version 24.0, WWBN AVideo's official Docker compose exposes a memcached service on all interfaces (port 11211), potentially allowing unauthenticated access.

The Hacker Wire@TheHackerWireDisclosure

The tweet announces CVE-2026-29093, noting that WWBN AVideo’s Docker setup exposes memcached on port 11211 without authentication, and links to a vulnerability report.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDisclosure

The post announces CVE-2026-29093, noting an unauthenticated PHP session store exposed through a memcached port, but provides no PoC, exploit, patch, or evidence of ongoing attacks.