CVE-2026-33512 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.
A vulnerability exists in the WWBN AVideo platform, specifically in versions through 26.0, within the API plugin. The issue arises because the `decryptString` action is exposed without authentication, allowing anyone to submit ciphertext and receive plaintext in return. This vulnerability can be exploited to recover protected tokens and metadata, as the ciphertext is publicly accessible through certain API endpoints. The vulnerability has been patched in a subsequent commit.
The vulnerability has been patched by requiring a valid API secret or admin access for the `decryptString` API endpoint. Users should rotate encryption keys or salts after applying the patch to invalidate any exposed ciphertexts.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/3fdeecef37bb88967a02ccc9b9acc8da95de1c13 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-312 | Cleartext Storage of Sensitive Information | [email protected] |
| CWE-326 | Inadequate Encryption Strength | [email protected] |
| CWE-327 | Use of a Broken or Risky Cryptographic Algorithm | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 25, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |