PT-2026-27192 · Avideo · Cdn Plugin+1

Restriction · Publicado 2026-03-23 · Atualizado 2026-03-26 · CVE-2026-33719

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string as the default key. When the CDN plugin is enabled and the key is not configured, the key validation check is bypassed. This allows unauthenticated attackers to modify the full CDN configuration, including CDN URLs, storage credentials, and the authentication key itself, via mass-assignment through the par request parameter.

Recommendations Update to a version after 26.0.

Exploit

Correção

Missing Authentication

Enumeração de Fraquezas

CWE-306

Identificadores relacionados

CVE-2026-33719

GHSA-R64R-883R-WCWH

Produtos afetados

Avideo

Cdn Plugin

Referências · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33719.json · Exploit
• https://github.com/WWBN/AVideo · Nota
• https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310 · Correção
• https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-33719 · Nota de Segurança
• https://reddit.com/r/VulnMatter/comments/1s475si/resumen_diario_de_vulnerabilidades_26032026 · Publicação no Reddit
• https://twitter.com/CveFindCom/status/2036167020589244886 · Publicação no Twitter
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Publicação no Reddit
• https://twitter.com/TheHackerWire/status/2036160767985328171 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-r64r-883r-wcwh · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-33719 · Aviso do Fabricante
• https://twitter.com/cyberbivash/status/2036189888299565365 · Publicação no Twitter