WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's `save.json.php` endpoint loads AI response objects using an attacker-controlled `$_REQUEST['id']` parameter without validating that the AI response belongs to the specified video. An authenticated user with AI permissions can reference any AI response ID — including those generated for other users' private videos — and apply the stolen AI-generated content (titles, descriptions, keywords, summaries, or full transcriptions) to their own video, effectively exfiltrating the information. Commit aa2c46a806960a0006105df47765913394eec142 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, three `list.json.php` endpoints in the Scheduler plugin lack any authentication check, while every other endpoint in the same plugin directories (`add.json.php`, `delete.json.php`, `index.php`) requires `User::isAdmin()`. An unauthenticated attacker can retrieve all scheduled tasks (including internal callback URLs and parameters), admin-composed email messages, and user-to-email targeting mappings by sending simple GET requests. Commit 83390ab1fa8dca2de3f8fa76116a126428405431 contains a patch.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.
CVE-2026-33723 is a high-severity SQL Injection vulnerability in WWBN AVideo versions up to 26.0. The flaw exists in the Subscribe::save() method where user input from $_POST['user_id'] is concatenated directly into an SQL INSERT statement without sanitization or parameterization. An authenticated attacker can exploit this to execute arbitrary SQL commands, potentially extracting sensitive data such as password hashes, API keys, and encryption salts. The vulnerability requires authentication but no user interaction beyond sending crafted requests. A patch has been committed to fix this issue. Organizations using affected versions should update promptly to prevent data breaches. The vulnerability impacts confidentiality severely, with limited impact on integrity and no impact on availability. Countries with significant WWBN AVideo usage and strategic interest in video platforms are at higher risk.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration — including CDN URLs, storage credentials, and the authentication key itself — via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch.
CVE-2026-33717 is a high-severity vulnerability in WWBN AVideo versions up to 26.0 that allows attackers to upload and persistently store executable PHP files in a web-accessible directory. This occurs because the downloadVideoFromDownloadURL() function saves remote content using the original filename and extension without proper validation, and an attacker can trigger an early termination that prevents cleanup of the malicious file. Exploiting this flaw can lead to remote code execution, compromising confidentiality, integrity, and availability of the affected system. No user interaction is required, but low privilege authentication is needed. A patch has been committed to address this issue. Organizations running vulnerable versions should urgently update to mitigate risk. Countries with significant AVideo deployments and strategic interest in video platforms are most at risk.
CVE-2026-33716 is a critical improper authentication vulnerability in WWBN AVideo versions up to 26.0. The flaw exists in the standalone live stream control endpoint, which accepts a user-controlled streamerURL parameter that redirects token verification to an attacker-controlled server. This bypasses authentication entirely, allowing unauthenticated attackers to control live streams, including stopping/starting recordings and dropping active publishers. The vulnerability has a CVSS score of 9.4, indicating high impact and ease of exploitation without any privileges or user interaction. A patch is available in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128. Organizations using affected versions should urgently apply the patch to prevent unauthorized live stream manipulation and potential service disruption.
CVE-2026-33690 is a medium severity vulnerability in WWBN AVideo versions up to 26.0 where the getRealIpAddr() function trusts user-controlled HTTP headers to determine client IP addresses. This allows attackers to spoof their IP by sending forged headers, potentially bypassing IP-based access controls and evading audit logs. The vulnerability stems from CWE-348: Use of Less Trusted Source. Exploitation requires no privileges or user interaction and can impact integrity by misleading security controls. A patch has been committed to address this issue. No known exploits are currently reported in the wild. Organizations using affected versions should apply the patch promptly and implement additional validation of client IP sources to mitigate risk.
CVE-2026-33688 is a medium severity vulnerability in WWBN AVideo versions up to 26.0 that allows unauthenticated attackers to enumerate valid usernames and account statuses via the password recovery endpoint. The flaw arises because the endpoint performs user existence and account status checks before captcha validation, returning distinct JSON error messages for valid, inactive, or banned accounts. This observable response discrepancy enables attackers to harvest user information at scale without solving captchas. While no known exploits are reported in the wild, this information disclosure can facilitate targeted attacks such as phishing or brute force. A patch addressing this issue has been committed but not linked here. Organizations using affected versions should apply the patch promptly and consider additional mitigations to limit user enumeration risks.
CVE-2026-33685 is a medium severity vulnerability in WWBN AVideo versions up to 26.0 where the JSON API endpoint for ad campaign reports lacks any authentication or authorization checks. This allows unauthenticated attackers to access sensitive ad analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. While the HTML and CSV report endpoints enforce admin checks, the JSON endpoint was left unprotected. The vulnerability does not allow modification of data or system compromise but leaks confidential business and user information. A patch has been committed to fix this missing authorization issue. Organizations using affected versions should update promptly to prevent unauthorized data disclosure.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, a sanitization order-of-operations flaw in the user profile "about" field allows any registered user to inject arbitrary JavaScript that executes when other users visit their channel page. The `xss_esc()` function entity-encodes input before `strip_specific_tags()` can match dangerous HTML tags, and `html_entity_decode()` on output reverses the encoding, restoring the raw malicious HTML. Commit 7cfdc380dae1e56bbb5de581470d9e9957445df0 contains a patch.
CVE-2026-33681 is a high-severity path traversal vulnerability in WWBN AVideo versions up to 26.0. The vulnerability exists in the objects/pluginRunDatabaseScript.json.php endpoint, which accepts a 'name' parameter without proper sanitization. An authenticated administrator or an attacker exploiting CSRF can traverse directories to execute arbitrary SQL scripts located outside the intended plugin directory. This allows execution of any install.sql file as raw SQL queries against the application database, potentially compromising confidentiality, integrity, and availability. The vulnerability requires administrative privileges or CSRF exploitation but does not require user interaction beyond that. A patch has been committed to address this issue.
CVE-2026-33651 is a high-severity SQL injection vulnerability in WWBN AVideo versions up to 26.0. The flaw exists in the remindMe.json.php endpoint where the live_schedule_id parameter is not properly sanitized before being concatenated into a SQL LIKE clause. Although some internal functions apply intval() to local copies, the original tainted input remains unsanitized, enabling authenticated users to perform time-based blind SQL injection attacks. This allows attackers to extract arbitrary database contents, compromising confidentiality and integrity without requiring user interaction. A patch has been committed to address this issue. Organizations using affected versions should prioritize updating to mitigate this risk.
CVE-2026-33650 is a high-severity authorization vulnerability in WWBN AVideo versions up to 26.0. It allows users with the 'Videos Moderator' permission, which is intended only for changing video publicity status, to escalate privileges and perform full video management operations including ownership transfer and deletion of any video. The flaw arises from inconsistent authorization checks between video editing and deletion endpoints, enabling a two-step exploit to first transfer ownership and then delete videos. This vulnerability can lead to unauthorized modification and removal of video content, impacting data integrity and availability. Exploitation requires low privileges but no user interaction, and the vulnerability has not been observed exploited in the wild yet. A patch has been committed to address this issue. Organizations using affected versions should prioritize updating to mitigate risks.
CVE-2026-33649 is a high-severity Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo versions up to 26.0. The vulnerability exists because the `plugin/Permissions/setPermission.json.php` endpoint accepts GET requests to change user group permissions without CSRF token validation. Additionally, the application sets session cookies with SameSite=None, allowing cross-site requests to carry session cookies. An unauthenticated attacker can craft a malicious webpage containing image tags that trigger permission changes when visited by an admin user, effectively escalating the attacker's privileges to near-admin level. No patches are currently available. Exploitation requires the admin to visit the attacker-controlled page but no authentication or user interaction beyond page visit is needed. The CVSS score is 8.
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the restreamer endpoint constructs a log file path by embedding user-controlled `users_id` and `liveTransmitionHistory_id` values from the JSON request body without any sanitization. This log file path is then concatenated directly into shell commands passed to `exec()`, allowing an authenticated user to achieve arbitrary command execution on the server via shell metacharacters such as `$()` or backticks. Commit 99b865413172045fef6a98b5e9bfc7b24da11678 contains a patch.
CVE-2026-33647 is a high-severity vulnerability in WWBN AVideo versions up to 26.0 that allows remote code execution via unrestricted upload of a file with a dangerous extension. The vulnerability arises because the application validates uploaded file content using MIME type detection but does not enforce an allowlist on the file extension derived from the user-supplied filename. Attackers can upload a crafted polyglot file containing valid JPEG headers followed by embedded PHP code with a . php extension. Since the MIME check passes, the file is saved as an executable PHP script in a web-accessible directory, enabling execution of arbitrary code on the server. No user interaction is required beyond file upload, and the exploit requires low privileges. A patch addressing this issue has been committed. Organizations running vulnerable versions should apply the patch immediately and implement stricter file extension validation to prevent exploitation.
CVE-2026-33513 is a high-severity path traversal vulnerability in WWBN AVideo versions up to 26.0. An unauthenticated API endpoint improperly concatenates user input into an include path without validation, allowing attackers to traverse directories and include arbitrary PHP files within the web root. This can lead to file disclosure and limited code execution of existing PHP files. If an attacker can upload or control PHP files elsewhere in the directory tree, this vulnerability can escalate to full remote code execution (RCE). No patches are currently available, and exploitation requires no authentication or user interaction. The vulnerability poses significant risk to organizations using AVideo for video hosting and streaming, especially those with publicly accessible instances. Immediate mitigations include restricting access to the vulnerable API, implementing input validation, and monitoring for suspicious file access patterns.