CVE-2026-33502 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a server-side request forgery caused by unauthenticated access in plugin/Live/test.php, letting remote attackers make the server send HTTP requests to arbitrary URLs, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can make the server send requests to internal or arbitrary URLs, potentially accessing sensitive internal resources.

Mitigation

Update to a version including commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 or later.

References

• https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3
• https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🔴 CVE-2026-33502 - Critical (9.3) WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbit... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33502/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner