CVE-2026-33763: Avideo: güvenlik açığı

Açıklama (NVD)

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

Özet bilgiler

Ürün

Wwbn Avideo

CVSS v3.1

5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS

%0,33 (yüzdelik 27)

CWE

CWE-307

Yama

Mevcut

Etkilenen sürümler

Kaynaklar

• NVD kaydı
• github.com
• github.com
• CWE-307