Authentication Bypass in WWBN AVideo CDN Plugin
CVE-2026-33719

8.6HIGH

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33719?

The WWBN AVideo platform has a vulnerability within its CDN plugin. In versions up to 26.0, the endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php are configured to use key-based authentication but default to an empty string if no key is set. This means that when the CDN plugin is enabled, a lack of configured keys allows attackers to bypass key validation completely. As a result, unauthorized individuals can manipulate the CDN configuration, including altering URLs, storage credentials, and even the authentication key itself through mass-assignment using the par request parameter. A patch has been implemented to address this issue.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-r...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f41...
x_refsource_MISC

CVSS V3.1

Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.