PT-2026-27167 · Unknown+1 · Url2Embed.Json.Php+1

Ahmad-Jarwan · Published 2026-03-20 · Updated 2026-03-23 · CVE-2026-33512

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.1

Description AVideo is an open source video platform. Versions up to and including 26.0 have an API plugin that exposes a decryptString action without authentication. This allows anyone to submit ciphertext and receive plaintext. The ciphertext is publicly available, for example, through the /view/url2Embed.json.php endpoint, enabling unauthorized recovery of protected tokens and metadata.

Recommendations Update to version 26.1 or later.

Exploit

Fix

Improper Authentication

Cleartext Storage of Sensitive Information

Use of a Broken Cryptographic Algorithm

Inadequate Encryption Strength

Weakness Enumeration

CWE-287

CWE-312

CWE-327

CWE-326

Related Identifiers

CVE-2026-33512

GHSA-MWJC-5J4X-R686

Affected Products

Avideo

Url2Embed.Json.Php

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33512.json · Exploit
• https://github.com/WWBN/AVideo/commit/3fdeecef37bb88967a02ccc9b9acc8da95de1c13 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mwjc-5j4x-r686 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33512 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33512 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note