CVE-2026-33719 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken access control caused by key-based authentication with a default empty key in CDN plugin endpoints, letting unauthenticated attackers modify CDN configuration via mass-assignment in 'par' parameter.

Severity & Score

Impact

Unauthenticated attackers can fully modify CDN configuration, including URLs and credentials, risking service disruption and credential compromise.

Mitigation

Update to a version including commit adeff0a31ba04a56f411eef256139fd7ed7d4310 or later.

References

• https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310
• https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner