PT-2026-26475 · Wwbn · Avideo+1

Fg0X0 · Published 2026-03-19 · Updated 2026-03-23 · CVE-2026-33297

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to 26.0

Description WWBN AVideo is an open source video platform. A logic error in the setPassword.json.php endpoint within the CustomizeUser plugin allows administrators to inadvertently set a channel password to zero for any user. This occurs because any password containing non-numeric characters is silently converted to the integer zero before being stored. Consequently, any visitor can bypass channel-level access control by simply guessing the password '0'. The endpoint, setPassword.json.php, processes the ProfilePassword request parameter using the intval() function, which converts alphanumeric strings to 0. This silent coercion means administrators are unaware that the intended password is not being stored correctly. The vulnerability affects channel-level access control and does not enable account takeover or privilege escalation, but it renders the password protection feature ineffective for non-numeric passwords.

Recommendations Versions prior to 26.0 should be updated to version 26.0 or later.

Exploit

Fix

LPE

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2026-33297

GHSA-6547-8HRG-C55M

Affected Products

Avideo

Customizeuser

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33297.json · Exploit
• https://github.com/WWBN/AVideo/commit/7a6a94631a0a18c313894395e6eb6703cca4abd0 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6547-8hrg-c55m · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33297 · Security Note
• https://osv.dev/vulnerability/GHSA-6547-8hrg-c55m · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33297 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/VulmonFeeds/status/2036111743617732635 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036114014812676541 · Twitter Post