CVE-2026-33296 Details
Description
WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site. Version 26.0 fixes the issue.
A open redirect vulnerability has been identified in WWBN AVideo versions prior to 26.0. The issue arises in the login process, where the user-supplied redirectUri parameter is directly reflected into a JavaScript document.location assignment without proper encoding for JavaScript context. This allows an attacker to redirect users to a malicious site after they complete the login process. The vulnerability exists in view/userLogin.php, where the redirectUri parameter is not adequately validated before being used.
Users can update to WWBN AVideo version 26.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-hj5h-5623-gwhw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/68d0fbb19e382fe62e6cc7bd48b51ffa1d9e310e | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-hj5h-5623-gwhw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | < 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | CVE Modified | CISA-ADP |
| Mar 22, 2026 | New CVE Received | [email protected] |