CVE-2026-33759
published 2026-03-27CVE-2026-33759: WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.29%
21.2th percentile
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| wwbn | avideo | <= 26.0 | — |
| wwbn | avideo | 0 – 26.0 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
ghsa·2026-03-26
CVE-2026-33759 [MEDIUM] CWE-639 AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
## Summary
The `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter.
## Details
The endpoint at `objects/playlistsVideos.json.php` accepts a `playlists_id` parameter and directly calls `PlayList::getVideosFromPlaylist()` with no ownership or visibility validation:
```php
// objects/playlistsVideos.json.php:24-28
if (empty($_REQUEST['play
OSV
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
osv·2026-03-26
CVE-2026-33759 [MEDIUM] AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents
## Summary
The `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter.
## Details
The endpoint at `objects/playlistsVideos.json.php` accepts a `playlists_id` parameter and directly calls `PlayList::getVideosFromPlaylist()` with no ownership or visibility validation:
```php
// objects/playlistsVideos.json.php:24-28
if (empty($_REQUEST['play
No detection rules found.
No public exploits indexed.
2026-03-27
Published