PT-2026-27189 · Avideo · Avideo

Zeroxjacks · Publicado 2026-03-23 · Atualizado 2026-03-25 · CVE-2026-33690

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. Versions up to and including 26.0 are affected by an issue where the getRealIpAddr() function in objects/functions.php relies on user-controlled HTTP headers to determine the client's IP address. An attacker can forge HTTP headers to spoof their IP address, potentially bypassing IP-based access controls and audit logging. The vulnerable function is getRealIpAddr(). The vulnerable file is objects/functions.php.

Recommendations Update AVideo to a version later than 26.0. As a temporary workaround, consider restricting or disabling the use of the getRealIpAddr() function until a patch is available.

Exploit

Correção

Enumeração de Fraquezas

CWE-348

Identificadores relacionados

CVE-2026-33690

GHSA-8P2X-5CPM-QRQW

Produtos afetados

Avideo

Referências · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33690.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8p2x-5cpm-qrqw · Aviso do Fabricante
• https://github.com/WWBN/AVideo/commit/1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c · Correção
• https://osv.dev/vulnerability/GHSA-8p2x-5cpm-qrqw · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33690 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33690 · Nota de Segurança