PT-2026-27188 · Avideo · Avideo

Restriction · Published 2026-03-23 · Updated 2026-03-25 · CVE-2026-33688

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 26.1

Description AVideo is an open source video platform. Versions up to and including 26.0 have an issue in the password recovery endpoint at objects/userRecoverPass.php. This endpoint performs user existence and account status checks before validating the captcha. An unauthenticated attacker can enumerate valid usernames and determine account status (active, inactive, or banned) without solving a captcha by observing distinct JSON error responses. The vulnerable functionality lies in the order of operations performed by the objects/userRecoverPass.php script.

Recommendations Update AVideo to version 26.1 or later.

Exploit

Fix

Weakness Enumeration

CWE-204

Related Identifiers

CVE-2026-33688

GHSA-M99F-MMVG-3XMX

Affected Products

Avideo

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33688.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx · Exploit
• https://github.com/WWBN/AVideo/commit/e42f54123b460fd1b2ee01f2ce3d4a386e88d157 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33688 · Security Note
• https://osv.dev/vulnerability/GHSA-m99f-mmvg-3xmx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-33688 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note