CVE-2026-33763

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

CVSS v3 5.3 MEDIUM

5.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/commit/01a0614fedcdaee47832c0d913a0fb86d8c28135	Patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-8prq-2jr2-cm92	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) WWBN AVideo es una plataforma de vídeo de código abierto. En versiones hasta la 26.0 inclusive, el endpoint de la API ’get_api_video_password_is_correct’ permite a cualquier usuario no autenticado verificar si una contraseña dada es correcta para cualquier vídeo protegido con contraseña. El endpoint devuelve un campo booleano ’passwordIsCorrect’ sin limitación de velocidad, CAPTCHA, ni requisito de autenticación, lo que permite ataques de fuerza bruta eficientes a velocidad offline contra las contraseñas de vídeo. El commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contiene un parche.

Information

Published : 2026-03-27 15:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-33763

Mitre link : CVE-2026-33763

CVE.ORG link : CVE-2026-33763

JSON object : View

Products Affected

wwbn

avideo

CWE

CWE-307

Improper Restriction of Excessive Authentication Attempts

{"id": "CVE-2026-33763", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33763", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T12:06:10.864677Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}]}], "published": "2026-03-27T15:16:58.390", "references": [{"url": "https://github.com/WWBN/AVideo/commit/01a0614fedcdaee47832c0d913a0fb86d8c28135", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-8prq-2jr2-cm92", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-307"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de v\u00eddeo de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el endpoint de la API \u2019get_api_video_password_is_correct\u2019 permite a cualquier usuario no autenticado verificar si una contrase\u00f1a dada es correcta para cualquier v\u00eddeo protegido con contrase\u00f1a. El endpoint devuelve un campo booleano \u2019passwordIsCorrect\u2019 sin limitaci\u00f3n de velocidad, CAPTCHA, ni requisito de autenticaci\u00f3n, lo que permite ataques de fuerza bruta eficientes a velocidad offline contra las contrase\u00f1as de v\u00eddeo. El commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contiene un parche."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}