CVE-2026-33719

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-33719", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-23T17:06:05.749Z", "datePublished": "2026-03-23T18:49:28.285Z", "dateUpdated": "2026-03-25T14:38:32.639Z"}, "containers": {"cna": {"title": "AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php", "problemTypes": [{"descriptions": [{"cweId": "CWE-306", "lang": "en", "description": "CWE-306: Missing Authentication for Critical Function", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh"}, {"name": "https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310", "tags": ["x_refsource_MISC"], "url": "https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T18:49:28.285Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration \u2014 including CDN URLs, storage credentials, and the authentication key itself \u2014 via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch."}], "source": {"advisory": "GHSA-r64r-883r-wcwh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-25T14:36:57.904434Z", "id": "CVE-2026-33719", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:38:32.639Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-33719", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-25T14:36:57.904434Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-25T14:38:22.072Z"}}], "cna": {"title": "AVideo Vulnerable to Unauthenticated CDN Configuration Takeover via Empty Default Key Bypass and Mass-Assignment in status.json.php", "source": {"advisory": "GHSA-r64r-883r-wcwh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310", "name": "https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration \u2014 including CDN URLs, storage credentials, and the authentication key itself \u2014 via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-306", "description": "CWE-306: Missing Authentication for Critical Function"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-23T18:49:28.285Z"}}}, "cveMetadata": {"cveId": "CVE-2026-33719", "state": "PUBLISHED", "dateUpdated": "2026-03-25T14:38:32.639Z", "dateReserved": "2026-03-23T17:06:05.749Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-23T18:49:28.285Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration \u2014 including CDN URLs, storage credentials, and the authentication key itself \u2014 via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, los endpoints del plugin CDN 'plugin/CDN/status.json.php' y 'plugin/CDN/disable.json.php' usan autenticaci\u00f3n basada en clave con una clave predeterminada de cadena vac\u00eda. Cuando el plugin CDN est\u00e1 habilitado pero la clave no ha sido configurada (el estado predeterminado), la verificaci\u00f3n de validaci\u00f3n de clave es completamente omitida, permitiendo a cualquier atacante no autenticado modificar la configuraci\u00f3n completa del CDN \u2014 incluyendo URLs de CDN, credenciales de almacenamiento y la propia clave de autenticaci\u00f3n \u2014 a trav\u00e9s de asignaci\u00f3n masiva mediante el par\u00e1metro de solicitud 'par'. El commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contiene un parche."}], "id": "CVE-2026-33719", "lastModified": "2026-06-17T10:37:58.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 4.7, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-33719", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-25T14:36:57.904434Z", "version": "2.0.3"}}]}, "published": "2026-03-23T19:16:42.647", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-306"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-03-25T17:32:19.018485+00:00", "value": {"mitigation_remediation": ["Upgrade AVideo to a release that includes commit adeff0a31ba04a56f411eef256139fd7ed7d4310, which restores proper key validation. ", "If an upgrade is not feasible, block access to plugin/CDN/status.json.php and plugin/CDN/disable.json.php in the web server configuration or disable the CDN plugin in the application. ", "After applying the patch or disabling the plugin, set a non\u2011empty authentication key in the CDN configuration to prevent future bypasses. ", "Review the application\u2019s plugin endpoints periodically to ensure no mass\u2011assignment vulnerabilities remain."], "summary": {"action": "Apply Patch", "impact": "Unauthenticated configuration takeover"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WWBN AVideo video platform, specifically versions up to and including 26.0, where the CDN plugin endpoints are present.", "description_and_impact": "A key\u2011based authentication check is omitted when the CDN plugin\u2019s authentication key remains the default empty string. This allows any user to access the plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php without credentials. The endpoints accept a par request parameter that can be used to mass\u2011assign configuration values, enabling an attacker to modify the entire CDN configuration, including URLs, storage credentials, and the authentication key itself.", "risk_and_exploitability": "The CVSS base score of 8.6 indicates a high severity. The EPSS score is less than 1\u202f%, implying a low probability of current exploitation. The vulnerability is not listed in the CISA KEV catalog. An attacker does not need any further authentication or privileged credentials; the flaw is exploitable simply by issuing HTTP requests to the exposed plugin URLs when the CDN plugin is enabled with its default empty key."}}}}, "created": "2026-03-24T10:33:10.411877+00:00", "updated": "2026-03-25T20:37:01.762803+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}