Summaryinfo

A vulnerability classified as problematic was found in WWBN AVideo up to 26.0. The affected element is the function get_api_video_password_is_correct of the component API Endpoint. Executing a manipulation of the argument passwordIsCorrect can lead to excessive authentication. This vulnerability is registered as CVE-2026-33763. It is possible to launch the attack remotely. No exploit is available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability has been found in WWBN AVideo up to 26.0 and classified as problematic. This vulnerability affects the function get_api_video_password_is_correct of the component API Endpoint. The manipulation of the argument passwordIsCorrect with an unknown input leads to a excessive authentication vulnerability. The CWE definition for the vulnerability is CWE-307. The product does not implement sufficient measures to prevent multiple failed authentication attempts within a short time frame, making it more susceptible to brute force attacks. As an impact it is known to affect confidentiality. CVE summarizes:

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

The advisory is shared for download at github.com. This vulnerability was named CVE-2026-33763 since 03/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1110.001.

Applying a patch is able to eliminate this problem.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 26.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion