PT-2026-25998 · Wwbn · Avideo

Offensiveee · Published 2026-03-17 · Updated 2026-03-20 · CVE-2026-33041

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions 25.0 and below

Description The /objects/encryptPass.json.php endpoint in WWBN AVideo exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes. The encryptPassword() function uses a weak hash chain (md5+whirlpool+sha1, no salt by default), making password cracking extremely fast with access to database hashes. The vulnerable file is objects/encryptPass.json.php, and the vulnerable function is encryptPassword(). The encryptPassword() function is located in objects/functions.php around line 2101. The vulnerable parameter is pass in the API endpoint /objects/encryptPass.json.php.

Recommendations Versions 25.0 and below should be updated to version 26.0 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-33041

GHSA-PX7X-GQ96-RMP5

Affected Products

Avideo

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33041.json · Exploit
• https://github.com/WWBN/AVideo/commit/ea2efd04464560cca93c9ab48b445dbb944a4e46 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-px7x-gq96-rmp5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-px7x-gq96-rmp5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33041 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33041 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2034891541945123127 · Twitter Post