PT-2026-25996 · Avideo · Avideo

Bugbunny-Research · Published 2026-03-17 · Updated 2026-03-22 · CVE-2026-33038

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions 25.0 and below

Description AVideo, an open source video platform, has an unauthenticated application takeover issue. The install/checkConfiguration.php endpoint allows full application initialization – database setup, admin account creation, and configuration file write – from unauthenticated POST input. The only existing safeguard is a check to see if videos/configuration.php already exists. On uninitialized deployments, a remote attacker can complete the installation with attacker-controlled credentials and a database, gaining full administrative access. The endpoint allows the attacker to supply their own database host, eliminating the need to guess database credentials. The admin user is created with attacker-controlled passwords and unsanitized input, potentially leading to SQL injection. The configuration file is written with attacker-controlled values, embedding database credentials and other settings. The CLI installer is protected, but the web endpoint is not, creating an inconsistent defense.

Recommendations Versions 25.0 and below: Add a one-time setup token to the installation process. Versions 25.0 and below: Restrict installer access to localhost or the command line interface only. Versions 25.0 and below: Parameterize SQL queries to prevent SQL injection. Versions 25.0 and below: Upgrade password hashing from md5() to password hash() with PASSWORD BCRYPT or PASSWORD ARGON2ID.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-33038

GHSA-2F9H-23F7-8GCX

Affected Products

Avideo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33038.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-2f9h-23f7-8gcx · Exploit
• https://github.com/WWBN/AVideo/commit/b3fa7869dcb935c8ab5c001a88dc29d2f92cf8e1 · Patch
• https://osv.dev/vulnerability/GHSA-2f9h-23f7-8gcx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33038 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33038 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/TheHackerWire/status/2035506684513427640 · Twitter Post
• https://twitter.com/pulsepatchio/status/2035728232532845029 · Twitter Post
• https://twitter.com/CVEnew/status/2034891544994492683 · Twitter Post