CVE-2026-33684: WWBN AVideo Privilege Escalation Flaw

CVE-2026-33684 Overview

CVE-2026-33684 is a privilege escalation vulnerability in WWBN AVideo, an open source video platform. Versions prior to 29.0 expose unguarded permission parameters in the signUp API. Any user who can solve a CAPTCHA can self-grant elevated permissions during account registration. The flaw resides in the set_api_signUp method within the API plugin, which accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input. The method applies these values to newly created accounts without verifying that the request was authenticated with a valid APISecret. This maps to Missing Authorization [CWE-862] and enables attackers to bypass administrator access controls.

Critical Impact
Unauthenticated attackers can self-grant email-verified status and upload, streaming, and meeting-creation permissions during registration, bypassing administrator-imposed restrictions on new accounts.

Affected Products

WWBN AVideo prior to version 29.0
AVideo API plugin set_api_signUp method
Deployments exposing the signUp API endpoint to untrusted networks

Discovery Timeline

2026-07-15 - CVE-2026-33684 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-33684

Vulnerability Analysis

The vulnerability exists in the set_api_signUp method of the AVideo API plugin. During account registration, the endpoint reads permission-related attributes directly from the client-supplied request body. These attributes include emailVerified, canUpload, canStream, and canCreateMeet. The method writes these values to the newly created user record without checking whether the request carries a valid APISecret. As a result, the CAPTCHA gate is the only obstacle between an anonymous attacker and elevated account attributes.

By asserting emailVerified=true, an attacker registers an account tied to an email address they do not control. This bypasses email-verification-gated functionality such as password reset flows and address-based trust decisions. By asserting canUpload, canStream, and canCreateMeet, the attacker gains capabilities that administrators typically withhold from new users to prevent abuse of media hosting and live streaming.

Root Cause

The root cause is missing authorization on privileged input fields. The set_api_signUp handler treats permission attributes as normal registration data rather than administrative fields. It does not enforce that only requests bearing the server-side APISecret may set these fields. This is a classic Broken Access Control pattern where a public endpoint accepts privileged parameters without segregation from user-controlled data.

Attack Vector

The attack vector is network-based and requires no prior authentication. An attacker submits a crafted HTTP POST request to the signUp API endpoint. The request includes standard registration fields plus emailVerified=1, canUpload=1, canStream=1, and canCreateMeet=1. After solving the CAPTCHA challenge, the server provisions the account with the requested privileges. The attacker then authenticates normally and exercises the granted capabilities. See the GitHub Security Advisory for further technical detail.

Detection Methods for CVE-2026-33684

Indicators of Compromise

Newly registered accounts with emailVerified set to true but no corresponding verification event in mail server logs.
New user records where canUpload, canStream, or canCreateMeet are enabled immediately at creation time rather than granted later by an administrator.
HTTP POST requests to the signUp API containing permission parameters such as canStream or canCreateMeet in the request body.

Detection Strategies

Review web server access logs for signUp API calls whose payloads include emailVerified, canUpload, canStream, or canCreateMeet parameters.
Correlate account creation events with the subsequent use of upload, streaming, or meeting-creation features within a short window.
Audit the AVideo user database for accounts created before upgrading to 29.0 that hold elevated permissions inconsistent with your provisioning policy.

Monitoring Recommendations

Enable verbose logging on the AVideo API plugin and forward logs to a centralized analytics platform for retention and query.
Alert on registration requests originating from IPs that also probe other API endpoints or exhibit CAPTCHA-solving automation patterns.
Track baseline ratios of new-user permission grants and alert on deviations following exposure of the vulnerable endpoint.

How to Mitigate CVE-2026-33684

Immediate Actions Required

Upgrade WWBN AVideo to version 29.0 or later, which removes the unguarded permission parameters from the signUp API.
Audit all user accounts created prior to the upgrade and revoke emailVerified, canUpload, canStream, and canCreateMeet flags that were not granted through administrative workflows.
Force password resets and re-verification for accounts flagged during the audit.

Patch Information

The issue is fixed in WWBN AVideo version 29.0. The patch ensures that emailVerified, canUpload, canStream, and canCreateMeet cannot be set from unauthenticated signUp requests and requires a valid APISecret for privileged attribute assignment. Refer to the GitHub Security Advisory GHSA-8j8m-p79x-g4jm for release notes and commit references.

Workarounds

Restrict access to the signUp API endpoint at the reverse proxy or web application firewall layer until the upgrade is applied.
Filter inbound signUp requests to strip emailVerified, canUpload, canStream, and canCreateMeet parameters from request bodies.
Disable open registration in AVideo settings and provision new users through administrative workflows only.

bash

# Example WAF rule (ModSecurity) to strip privileged signUp parameters
SecRule REQUEST_URI "@contains /plugin/API/set.php" \
  "id:1026336840,phase:2,pass,nolog,\
   ctl:ruleRemoveTargetByTag=OWASP_CRS;ARGS:emailVerified,\
   t:none,\
   chain"
  SecRule ARGS_NAMES "@rx ^(emailVerified|canUpload|canStream|canCreateMeet)$" \
    "t:none,setvar:tx.block=1,deny,status:403,\
     msg:'Blocked privileged signUp parameter (CVE-2026-33684)'"