CVE-2026-33763 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.
A vulnerability exists in WWBN AVideo versions through 26.0, specifically in the 'get_api_video_password_is_correct' API endpoint. This endpoint allows any unauthenticated user to check if a password is correct for password-protected videos. The response includes a boolean 'passwordIsCorrect' value, and the endpoint lacks rate limiting, CAPTCHA, or authentication requirements. This combination enables efficient offline brute-force attacks on video passwords. The vulnerability arises because video passwords are stored in plaintext, and the comparison in the API endpoint uses loose equality, making it susceptible to exploitation.
Users are advised to update to the latest version of WWBN AVideo, where this vulnerability has been patched. Instructions for updating can be found in the AVideo documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/01a0614fedcdaee47832c0d913a0fb86d8c28135 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-8prq-2jr2-cm92 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | New CVE Received | [email protected] |