CVE-2026-33512
published 2026-03-23CVE-2026-33512: WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication…
PriorityP347high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.23%
14.1th percentile
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
osv·2026-03-20
CVE-2026-33512 [HIGH] AVideo has an unauthenticated decrypt oracle leaking any ciphertext
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
### Summary
The API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.
### Details
- Entry: `plugin/API/get.json.php` is unauthenticated.
- Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966):
```php
$string = decryptString($_REQUEST['string']);
return new ApiObject($string, empty($string));
```
No APISecret or user check occurs before decrypting.
- Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.
### PoC
1. Obta
GHSA
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
ghsa·2026-03-20
CVE-2026-33512 [HIGH] CWE-287 AVideo has an unauthenticated decrypt oracle leaking any ciphertext
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
### Summary
The API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.
### Details
- Entry: `plugin/API/get.json.php` is unauthenticated.
- Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966):
```php
$string = decryptString($_REQUEST['string']);
return new ApiObject($string, empty($string));
```
No APISecret or user check occurs before decrypting.
- Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.
### PoC
1. Obta
No detection rules found.
No public exploits indexed.
2026-03-23
Published