CVE-2026-29093 is a high severity flaw (CVSS 8.1) in WWBN AVideo, an open source video platform. Before version 24.0, the official docker-compose.yml published an unauthenticated memcached service on port 11211, and PHP kept all user sessions in it. Upgrade to 24.0 and make sure port 11211 is not reachable from outside.
What's affected
WWBN AVideo versions before 24.0 are affected. The GitHub advisory lists 24.0 and later as patched. The risk comes from the stock docker-compose.yml, so installs that used the official compose file are the ones to look at first.
The NVD record rates the attack complexity as high, because exploitation needs port 11211 to be reachable from the attacker's network. A host behind a strict firewall or security group is much harder to abuse than one with the port open to the internet.
How to check if you're exposed
Look at how memcached is published on the Docker host. These commands only read state:
docker compose ps
docker compose config | grep -n 11211
ss -ltn | grep 11211
If the compose output maps 11211:11211 and ss shows the port listening on 0.0.0.0 or ::, memcached is published to the host network. Then check from a second machine, or from your cloud console, whether security group or firewall rules allow inbound traffic to that port. Also check the AVideo release you run against 24.0.
What to do now
- Upgrade AVideo to 24.0 or later, and pull the updated
docker-compose.ymlfrom that release rather than keeping your old copy. - Remove or restrict the
ports:entry for the memcached service so it is only reachable on the internal Docker network. The advisory notes the database services already work this way. - Block inbound access to port 11211 at the host firewall and at your cloud security group, whatever the compose file says.
- If the port was ever open to untrusted networks, treat sessions as exposed. Flush them, force a fresh login for all users and rotate admin credentials.
- Keep a current inventory of container images and compose files so the next exposed service shows up in review. Run the free in-browser dependency scan at https://gold.safeguard.sh/scan to see whether the affected package is in your lockfile or SBOM.
Why it matters
The advisory ties the issue to two weaknesses, CWE-668 (exposure of a resource to the wrong sphere) and CWE-287 (improper authentication). Memcached has no authentication enabled in this setup, so anyone who can open a TCP connection can talk to it. Because PHP sessions live there, the cache holds the application's login state: user IDs, admin flags and similar data.
The advisory describes three outcomes: reading sessions to hijack accounts, changing session data to gain admin rights, and wiping every session to log all users out. None of that needs an application login. It is a good reminder that a convenience port mapping in a compose file can undo the access control in the application. The record does not flag this CVE as exploited in the wild, and it is not in the CISA KEV catalog.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is this only a problem if the port is open to the internet?
The port has to be reachable by the attacker. That is why the attack complexity is rated high. Still, internal networks, shared hosts and misconfigured cloud rules can all make it reachable, so close it anyway.
Does upgrading alone fix everything?
The advisory lists 24.0 as patched. Also check your own compose file and firewall, since old sessions may already have been read.
Sources
Last reviewed: 19 October 2026.
