CVE-2026-33488 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken authentication caused by use of weak 512-bit RSA keys in the LoginControl plugin's PGP 2FA system and unauthenticated key generation endpoints, letting attackers bypass 2FA and cause resource exhaustion, exploit requires no authentication.

Severity & Score

Impact

Attackers can bypass two-factor authentication and cause CPU exhaustion via unauthenticated key generation.

Mitigation

Apply patch from commit 00d979d87f8182095c8150609153a43f834e351e or update to a fixed version.

References

• https://github.com/WWBN/AVideo/commit/00d979d87f8182095c8150609153a43f834e351e
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6m5f-j7w2-w953

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner