CVE-2026-33719 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken access control caused by key-based authentication with a default empty key in CDN plugin endpoints, letting unauthenticated attackers modify CDN configuration via mass-assignment in 'par' parameter.

Severity & Score

Impact

Unauthenticated attackers can fully modify CDN configuration, including URLs and credentials, risking service disruption and credential compromise.

Mitigation

Update to a version including commit adeff0a31ba04a56f411eef256139fd7ed7d4310 or later.

References

• https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310
• https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 23, 2026

🟠 CVE-2026-33719 - High (8.6) WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33719/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner