PT-2026-27190 · Avideo · Avideo

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-27 · CVE-2026-33716

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The standalone live stream control endpoint at plugin/Live/standAloneFiles/control.json.php accepts a user-supplied streamerURL parameter that allows an attacker to redirect token verification requests to a server they control. By returning a specific response ({"error": false}), an attacker can bypass authentication and gain unauthenticated control over any live stream on the platform. This control includes the ability to drop active publishers, start or stop recordings, and probe stream existence. The commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch to address this issue.

Recommendations Versions up to and including 26.0 should be updated to commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128.

Exploit

Correção

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2026-33716

GHSA-9HV9-GVWM-95F2

Produtos afetados

Avideo

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33716.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2 · Aviso do Fabricante
• https://github.com/WWBN/AVideo/commit/388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 · Correção
• https://twitter.com/TheHackerWire/status/2036160626238890124 · Publicação no Twitter
• https://twitter.com/cyberbivash/status/2036189945254060180 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-33716 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-33716 · Aviso do Fabricante
• https://twitter.com/0dayPublishing/status/2036452848888655990 · Publicação no Twitter
• https://twitter.com/CveFindCom/status/2036166938523517123 · Publicação no Twitter
• https://twitter.com/pulsepatchio/status/2037543180153884718 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-9hv9-gvwm-95f2 · Aviso do Fabricante