CVE-2026-29093: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-29093 Overview

WWBN AVideo is an open source video platform that, prior to version 24.0, contains a critical authentication bypass vulnerability in its default Docker deployment configuration. The official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication.

Critical Impact

Unauthenticated remote attackers can hijack user sessions, impersonate administrators, and cause mass session destruction by accessing the exposed memcached service on port 11211.

Affected Products

• WWBN AVideo versions prior to 24.0
• AVideo Docker deployments using the default docker-compose.yml configuration
• Any deployment exposing memcached on port 11211 without network restrictions

Discovery Timeline

• 2026-03-06 - CVE CVE-2026-29093 published to NVD
• 2026-03-09 - Last updated in NVD database

Technical Details for CVE-2026-29093

Vulnerability Analysis

This vulnerability represents a classic insecure default configuration issue (CWE-287: Improper Authentication) that creates a direct path to session hijacking. The root problem lies in the intersection of two design decisions: exposing memcached on all network interfaces without authentication, and using that same memcached instance as the PHP session storage backend.

Memcached, by design, does not implement authentication — it was intended for trusted internal networks. When exposed to untrusted networks via the 0.0.0.0:11211 binding in the default Docker Compose configuration, any network-accessible attacker gains full read/write access to the session store. Since PHP sessions contain authentication state, session tokens, and user identity information, this exposure enables complete authentication bypass.

Root Cause

The vulnerability stems from the default docker-compose.yml configuration binding memcached to all network interfaces (0.0.0.0:11211) without any access controls. Combined with PHP's session handler configuration that stores all user sessions in memcached, this creates an unauthenticated pathway to the session store. Memcached's protocol lacks built-in authentication mechanisms, making network-level isolation the only protection — which the default configuration fails to provide.

Attack Vector

The attack vector is network-based. An attacker with network access to port 11211 can connect directly to the memcached service using standard memcached clients or tools like telnet or netcat. From there, the attacker can:

1. Enumerate active session keys to identify logged-in users
2. Read session data to obtain session tokens and user credentials
3. Modify session data to escalate privileges or impersonate administrators
4. Flush all sessions to cause a denial-of-service condition affecting all authenticated users

The memcached protocol supports simple text commands such as stats items, stats cachedump, get, set, and flush_all that facilitate these attacks without any authentication challenge.

Detection Methods for CVE-2026-29093

Indicators of Compromise

• Unexpected connections to port 11211 from external IP addresses or untrusted network segments
• Unusual memcached command patterns including stats cachedump, get, or flush_all from non-application sources
• Mass session invalidations or unexpected user logouts across the platform
• Administrative actions performed by accounts whose legitimate owners were not active

Detection Strategies

• Monitor network traffic to port 11211 for connections originating outside the expected container network or localhost
• Implement intrusion detection rules to alert on memcached protocol commands from unauthorized sources
• Audit Docker Compose configurations for services bound to 0.0.0.0 that should be internal-only
• Review authentication and session logs for anomalous session creation or privilege escalation events

Monitoring Recommendations

• Deploy network segmentation monitoring to detect cross-boundary access to memcached services
• Implement real-time alerting on memcached flush_all commands which may indicate active exploitation
• Monitor for unusual patterns in session creation and destruction that could indicate session manipulation
• Establish baseline memcached access patterns to identify deviations indicative of unauthorized access

How to Mitigate CVE-2026-29093

Immediate Actions Required

• Upgrade WWBN AVideo to version 24.0 or later which contains the security fix
• Restrict memcached network binding to localhost (127.0.0.1:11211) or the internal Docker network only
• Implement firewall rules to block external access to port 11211
• Review active sessions and consider invalidating all sessions if compromise is suspected

Patch Information

WWBN has released version 24.0 which addresses this vulnerability. The patch modifies the default Docker Compose configuration to prevent the memcached service from being exposed on external network interfaces. Organizations should upgrade to version 24.0 or later immediately. For detailed information, refer to the GitHub AVideo Release 24.0 and the GitHub Security Advisory GHSA-xxpw-32hf-q8v9.

Workarounds

• Modify docker-compose.yml to bind memcached to 127.0.0.1:11211 instead of 0.0.0.0:11211
• Remove the port mapping entirely if memcached only needs to be accessible within the Docker network
• Deploy network firewall rules to restrict access to port 11211 to only trusted internal addresses
• Consider placing memcached behind a VPN or private network segment inaccessible from the public internet

# Configuration example - Secure docker-compose.yml memcached configuration
# Change the memcached port binding from exposed to internal-only
# Original (vulnerable): ports: - "11211:11211"
# Secure option 1: Bind to localhost only
ports:
  - "127.0.0.1:11211:11211"

# Secure option 2: Remove port mapping entirely (recommended)
# Comment out or remove the ports section for memcached
# memcached will only be accessible via Docker internal network