CVE-2026-33649 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a cross-site request forgery vulnerability caused by lack of CSRF token validation in plugin/Permissions/setPermission.json.php, letting unauthenticated attackers escalate privileges by tricking admins, exploit requires admin to visit attacker-controlled page.

Severity & Score

Impact

Unauthenticated attackers can escalate privileges to near-admin by tricking admins into visiting malicious pages.

Mitigation

Update to the latest version once a patch is available or implement CSRF token validation and secure cookie settings.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner