CVE-2026-29093

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.

Summary

The official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication.

Severity

High (CVSS 3.1: 8.1)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network — docker-compose.yml binds memcached to 0.0.0.0:11211 on the host
• Attack Complexity: High — exploitation requires port 11211 to be network-reachable, which depends on external firewall/security group configuration beyond the attacker's control
• Privileges Required: None — memcached has no authentication mechanism enabled
• User Interaction: None
• Scope: Unchanged — impact is to the AVideo application's session management
• Confidentiality Impact: High — session data includes user IDs, admin flags, email addresses, and password hashes
• Integrity Impact: High — an attacker can modify session data to inject admin privileges or impersonate any user
• Availability Impact: High — flush_all destroys all active sessions, forcing mass logout

Affected Component

• docker-compose.yml — memcached service ports directive (line 203)
• Dockerfile — PHP session configuration (lines 150-151)

CWE

• CWE-668: Exposure of Resource to Wrong Sphere
• CWE-287: Improper Authentication (memcached has no authentication)

Description

Memcached port unnecessarily published to host network

The docker-compose.yml publishes the memcached port to the Docker host's network interface:

# docker-compose.yml — lines 192-213
  memcached:
    image: memcached:alpine
    restart: unless-stopped
    command: >
      memcached -m 512 -c 2048 -t ${NPROC:-4} -R 200
    ports:
      - "${MEMCACHE_PORT:-11211}:11211"    # <-- Exposes to 0.0.0.0:11211
    networks:
      - app_net

The memcached command has no authentication flags:

• No -S flag (SASL authentication)
• No -l 127.0.0.1 flag (interface binding restriction)

The default env.example reinforces this port:

MEMCACHE_PORT=11211

PHP sessions stored entirely in memcached

The Dockerfile configures PHP to use memcached as the session store:

; Dockerfile — lines 150-151
session.save_handler           = memcached
session.save_path              = "memcached:11211?persistent=1&timeout=2&retry_interval=5"

Session data contains all authentication state

The application stores complete authentication state in sessions. From objects/user.php:

// user.php:1521 — login check
$isLogged = !empty($_SESSION['user']['id']);

// user.php:1544 — admin check
return !empty($_SESSION['user']['isAdmin']);

Session data includes: user ID, email, username, password hash, admin flag, channel name, photo URL, and email verification status (user.php lines 329-733). All of this is readable and writable via the exposed memcached port.

Inconsistent defense: database services are correctly internal-only

The docker-compose.yml demonstrates awareness of proper service isolation — both database services have NO ports: directive:

# docker-compose.yml — database service (lines 136-163)
  database:
    build:
      context: .
      dockerfile: Dockerfile.mariadb
    # ... NO ports: directive — internal only
    networks:
      - app_net

# docker-compose.yml — database_encoder service (lines 165-189)
  database_encoder:
    build:
      context: .
      dockerfile: Dockerfile.mariadb
    # ... NO ports: directive — internal only
    networks:
      - app_net

Both databases are only reachable via the internal app_net Docker network. Memcached — which stores equally sensitive session data — should follow the same…

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.

WWBN AVideo is an open source video platform. Prior to version 24.0, the official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication. This issue has been patched in version 24.0.

Summary

The official docker-compose.yml publishes the memcached service on host port 11211 (0.0.0.0:11211) with no authentication, while the Dockerfile configures PHP to store all user sessions in that memcached instance. An attacker who can reach port 11211 can read, modify, or flush session data — enabling session hijacking, admin impersonation, and mass session destruction without any application-level authentication.

Severity

High (CVSS 3.1: 8.1)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector: Network — docker-compose.yml binds memcached to 0.0.0.0:11211 on the host
• Attack Complexity: High — exploitation requires port 11211 to be network-reachable, which depends on external firewall/security group configuration beyond the attacker's control
• Privileges Required: None — memcached has no authentication mechanism enabled
• User Interaction: None
• Scope: Unchanged — impact is to the AVideo application's session management
• Confidentiality Impact: High — session data includes user IDs, admin flags, email addresses, and password hashes
• Integrity Impact: High — an attacker can modify session data to inject admin privileges or impersonate any user
• Availability Impact: High — flush_all destroys all active sessions, forcing mass logout

Affected Component

• docker-compose.yml — memcached service ports directive (line 203)
• Dockerfile — PHP session configuration (lines 150-151)

CWE

• CWE-668: Exposure of Resource to Wrong Sphere
• CWE-287: Improper Authentication (memcached has no authentication)

Description

Memcached port unnecessarily published to host network

The docker-compose.yml publishes the memcached port to the Docker host's network interface:

# docker-compose.yml — lines 192-213
  memcached:
    image: memcached:alpine
    restart: unless-stopped
    command: >
      memcached -m 512 -c 2048 -t ${NPROC:-4} -R 200
    ports:
      - "${MEMCACHE_PORT:-11211}:11211"    # <-- Exposes to 0.0.0.0:11211
    networks:
      - app_net

The memcached command has no authentication flags:

• No -S flag (SASL authentication)
• No -l 127.0.0.1 flag (interface binding restriction)

The default env.example reinforces this port:

MEMCACHE_PORT=11211

PHP sessions stored entirely in memcached

The Dockerfile configures PHP to use memcached as the session store:

; Dockerfile — lines 150-151
session.save_handler           = memcached
session.save_path              = "memcached:11211?persistent=1&timeout=2&retry_interval=5"

Session data contains all authentication state

The application stores complete authentication state in sessions. From objects/user.php:

// user.php:1521 — login check
$isLogged = !empty($_SESSION['user']['id']);

// user.php:1544 — admin check
return !empty($_SESSION['user']['isAdmin']);

Session data includes: user ID, email, username, password hash, admin flag, channel name, photo URL, and email verification status (user.php lines 329-733). All of this is readable and writable via the exposed memcached port.

Inconsistent defense: database services are correctly internal-only

The docker-compose.yml demonstrates awareness of proper service isolation — both database services have NO ports: directive:

# docker-compose.yml — database service (lines 136-163)
  database:
    build:
      context: .
      dockerfile: Dockerfile.mariadb
    # ... NO ports: directive — internal only
    networks:
      - app_net

# docker-compose.yml — database_encoder service (lines 165-189)
  database_encoder:
    build:
      context: .
      dockerfile: Dockerfile.mariadb
    # ... NO ports: directive — internal only
    networks:
      - app_net

Both databases are only reachable via the internal app_net Docker network. Memcached — which stores equally sensitive session data — should follow the same…