PT-2026-27192 · Avideo · Cdn Plugin+1

Restriction · Published 2026-03-23 · Updated 2026-03-26 · CVE-2026-33719

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string as the default key. When the CDN plugin is enabled and the key is not configured, the key validation check is bypassed. This allows unauthenticated attackers to modify the full CDN configuration, including CDN URLs, storage credentials, and the authentication key itself, via mass-assignment through the par request parameter.

Recommendations Update to a version after 26.0.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-33719

GHSA-R64R-883R-WCWH

Affected Products

Avideo

Cdn Plugin

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33719.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh · Vendor Advisory
• https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310 · Patch
• https://osv.dev/vulnerability/CVE-2026-33719 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33719 · Security Note
• https://osv.dev/vulnerability/GHSA-r64r-883r-wcwh · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://reddit.com/r/VulnMatter/comments/1s475si/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post
• https://twitter.com/CveFindCom/status/2036167020589244886 · Twitter Post
• https://twitter.com/TheHackerWire/status/2036160767985328171 · Twitter Post
• https://twitter.com/cyberbivash/status/2036189888299565365 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s473iq/resumen_diario_de_vulnerabilidades_26032026 · Reddit Post