PT-2026-26474 · Wwbn · Avideo

Fg0X0 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33296

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 26.0

Description WWBN AVideo, an open source video platform, contains an open redirect issue in the login process. A user-supplied redirectUri parameter is directly included in a JavaScript document.location assignment without proper encoding. After a user completes the login popup, a timer callback uses this unvalidated value to redirect the user to a site controlled by an attacker. The vulnerable code is located in view/userLogin.php, where the application accepts a redirectUri GET parameter, passes it through the isSafeRedirectURL() function, and stores the result in $safeRedirectUri. This value is then embedded into a JavaScript block without appropriate encoding, allowing for exploitation through protocol-relative URLs like //evil.com or subdomain confusion techniques. The attack requires a victim to follow a crafted link and interact with the login popup, enabling phishing attacks.

Recommendations Versions prior to 26.0 should be updated to version 26.0 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-33296

GHSA-HJ5H-5623-GWHW

Affected Products

Avideo

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33296.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-hj5h-5623-gwhw · Exploit
• https://github.com/WWBN/AVideo/commit/68d0fbb19e382fe62e6cc7bd48b51ffa1d9e310e · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33296 · Security Note
• https://osv.dev/vulnerability/GHSA-hj5h-5623-gwhw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33296 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2035781347613053327 · Twitter Post
• https://twitter.com/CVEnew/status/2035992497030066646 · Twitter Post