WWBN AVideo up to 28.x signUp API set_api_signUp emailVerified/canUpload/canStream/canCreateMeet permission

Summaryinfo

A vulnerability marked as critical has been reported in WWBN AVideo up to 28.x. Affected is the function set_api_signUp of the component signUp API. This manipulation of the argument emailVerified/canUpload/canStream/canCreateMeet causes permission. This vulnerability is handled as CVE-2026-33684. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 28.x. It has been declared as critical. Affected by this vulnerability is the function set_api_signUp of the component signUp API. The manipulation of the argument emailVerified/canUpload/canStream/canCreateMeet with an unknown input leads to a permission vulnerability. The CWE definition for the vulnerability is CWE-275. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any user who can solve a CAPTCHA to self-grant elevated permissions during account registration. The set_api_signUp method in the API plugin accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applies them to newly created accounts without verifying that the request was authenticated with a valid APISecret. By self-granting account attributes, attackers can mark their own accounts as email-verified without owning the address (bypassing email-gated functionality) and award themselves upload, streaming, and meeting-creation permissions, circumventing administrator access controls that intentionally restrict these capabilities for new users. This issue has been fixed in version 29.0

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-33684 since 03/23/2026. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1222 according to MITRE ATT&CK.

Upgrading to version 29.0 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 28.x

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion