PT-2026-27188 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33688

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.1

Description AVideo is an open source video platform. Versions up to and including 26.0 have an issue in the password recovery endpoint at objects/userRecoverPass.php. This endpoint performs user existence and account status checks before validating the captcha. An unauthenticated attacker can enumerate valid usernames and determine account status (active, inactive, or banned) without solving a captcha by observing distinct JSON error responses. The vulnerable functionality lies in the order of operations performed by the objects/userRecoverPass.php script.

Recommendations Update AVideo to version 26.1 or later.

Exploit

Correção

Enumeração de Fraquezas

CWE-204

Identificadores relacionados

CVE-2026-33688

GHSA-M99F-MMVG-3XMX

Produtos afetados

Avideo

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33688.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/e42f54123b460fd1b2ee01f2ce3d4a386e88d157 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2026-33688 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-m99f-mmvg-3xmx · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33688 · Aviso do Fabricante