CVE-2026-33764 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endpoint loads AI response objects using an attacker-controlled `$_REQUEST['id']` parameter without validating that the AI response belongs to the specified video. An authenticated user with AI permissions can reference any AI response ID — including those generated for other users' private videos — and apply the stolen AI-generated content (titles, descriptions, keywords, summaries, or full transcriptions) to their own video, effectively exfiltrating the information. Commit aa2c46a806960a0006105df47765913394eec142 contains a patch.
An Insecure Direct Object Reference (IDOR) vulnerability has been identified in the WWBN AVideo AI plugin, specifically in versions through 26.0. The issue arises in the 'save.json.php' endpoint, which improperly loads AI response objects using an attacker-controlled 'id' parameter. This lack of validation allows authenticated users with AI permissions to access AI response IDs from other users' private videos and apply the stolen content—such as titles, descriptions, keywords, summaries, or full transcriptions—to their own videos. The vulnerability effectively exfiltrates private information without authorization.
The vulnerability has been patched in version 26.0. Users should update to this version to address the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-g39v-qrj6-jxrh | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/aa2c46a806960a0006105df47765913394eec142 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-g39v-qrj6-jxrh | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-639 | Authorization Bypass Through User-Controlled Key | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 27, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | New CVE Received | [email protected] |