Critical severity · published Mar 23, 2026
CVE-2026-33297
AVideo has an IDOR - Any Admin Can Set Another User's Channel Password via setPassword.json.php
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control. Version 26.0 contains a patch for the issue.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 29% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
AVideo · WWBN
< 26.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-33297
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-33297
Patch
https://github.com/WWBN/AVideo/commit/7a6a94631a0a18c313894395e6eb6703cca4abd0
Exploit
https://github.com/WWBN/AVideo/security/advisories/GHSA-6547-8hrg-c55m
More from AVideo
10.0
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
10.0
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
9.9
CVE-2022-30547
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
9.8
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
9.8
CVE-2026-85154
WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash