by Kastro
Paper/Archive/CVE-2026-33867

CVE-2026-33867

WWBN AVideo — AVideo has Plaintext Video Password Storage

EPSS 0.2%public exploitCVSS 9.1
critical.is priorityof 100
38
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 4.6.046 × 200.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.

Affected

ProductAffectedFixed inSource
AVideo<= 26.0–CNA

Scores by source

GitHub_M (CNA)9.1CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: total

References

exploitgithub.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wgrefgithub.com/WWBN/AVideo/commit/f2d68d2adbf73588ea61be2b781d93120a819e36