PT-2026-27190 · Avideo · Avideo

Restriction · Published 2026-03-23 · Updated 2026-03-27 · CVE-2026-33716

Positive Technologies (AI Summary)

CVSS v3.1

9.4

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The standalone live stream control endpoint at plugin/Live/standAloneFiles/control.json.php accepts a user-supplied streamerURL parameter that allows an attacker to redirect token verification requests to a server they control. By returning a specific response ({"error": false}), an attacker can bypass authentication and gain unauthenticated control over any live stream on the platform. This control includes the ability to drop active publishers, start or stop recordings, and probe stream existence. The commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch to address this issue.

Recommendations Versions up to and including 26.0 should be updated to commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-33716

GHSA-9HV9-GVWM-95F2

Affected Products

Avideo

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33716.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2 · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-33716 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33716 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9hv9-gvwm-95f2 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/TheHackerWire/status/2036160626238890124 · Twitter Post
• https://twitter.com/cyberbivash/status/2036189945254060180 · Twitter Post
• https://twitter.com/0dayPublishing/status/2036452848888655990 · Twitter Post
• https://twitter.com/CveFindCom/status/2036166938523517123 · Twitter Post
• https://twitter.com/pulsepatchio/status/2037543180153884718 · Twitter Post