CVE-2026-33037 Details
Description
WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0.
A vulnerability exists in WWBN AVideo versions through 25.0, where the official Docker deployment files include a default admin password of 'password'. This default is used to create the admin account during installation. Instances deployed without changing the SYSTEM_ADMIN_PASSWORD are vulnerable to easy administrative takeover. The application lacks safeguards such as a mandatory password change upon first login, password complexity requirements, and detection of default passwords. Additionally, the password is hashed using the weak MD5 algorithm. Full admin access allows for exposure of user data, manipulation of content, and potential remote code execution through file uploads and plugin management. This insecure default also applies to database credentials, further increasing the risk.
Users should update to AVideo version 26.0 or later, and ensure that the SYSTEM_ADMIN_PASSWORD is set to a strong, unique password before deployment.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/2075fac1a51f21fab5d8592235a095aa354a9de6 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | < 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | New CVE Received | [email protected] |