CVE-2026-33685: Wwbn Avideo Information Disclosure Flaw

CVE-2026-33685 Overview

WWBN AVideo is an open source video platform that contains a missing authorization vulnerability in versions up to and including 26.0. The plugin/AD_Server/reports.json.php endpoint performs no authentication or authorization checks, allowing any unauthenticated attacker to extract ad campaign analytics data. This sensitive information includes video titles, user channel names, user IDs, ad campaign names, and impression/click counts. While the HTML counterpart (reports.php) and CSV export (getCSV.php) both correctly enforce User::isAdmin(), the JSON API was left unprotected.

Critical Impact

Unauthenticated attackers can access sensitive ad campaign analytics data, user information, and business intelligence without any credentials, potentially exposing competitive insights and user privacy data.

Affected Products

• WWBN AVideo versions up to and including 26.0
• AVideo installations with the AD_Server plugin enabled
• Self-hosted AVideo video platform deployments

Discovery Timeline

• 2026-03-23 - CVE-2026-33685 published to NVD
• 2026-03-25 - Last updated in NVD database

Technical Details for CVE-2026-33685

Vulnerability Analysis

This vulnerability is classified as CWE-862 (Missing Authorization), representing a fundamental access control flaw in the AVideo platform's AD_Server plugin. The root issue stems from an inconsistent implementation of authorization checks across different endpoint formats serving the same data.

The vulnerability exists because the JSON API endpoint (reports.json.php) was developed without implementing the same authorization controls present in related endpoints. While both reports.php (HTML output) and getCSV.php (CSV export) properly verify administrator privileges using the User::isAdmin() function before returning data, this check was omitted from the JSON endpoint.

Successful exploitation enables attackers to harvest business-sensitive analytics data through simple unauthenticated HTTP requests. The exposed data includes user identifiers, channel names, video titles, ad campaign names, and detailed impression/click metrics that could be leveraged for competitive intelligence gathering, targeted attacks against users, or understanding platform engagement patterns.

Root Cause

The vulnerability originates from incomplete access control implementation during the development of the AD_Server plugin's reporting functionality. The JSON API endpoint plugin/AD_Server/reports.json.php lacks the User::isAdmin() authorization check that protects both the HTML and CSV export endpoints. This oversight creates an unprotected avenue to access sensitive analytics data that was intended to be restricted to administrator users only.

Attack Vector

Exploitation requires only network access to the vulnerable AVideo instance. An attacker can directly request the plugin/AD_Server/reports.json.php endpoint without providing any authentication credentials. The endpoint returns the complete ad campaign analytics dataset in JSON format, including user identifiers, channel information, video metadata, campaign details, and engagement statistics. No user interaction is required, and the attack can be performed entirely remotely over HTTP/HTTPS.

The vulnerability is straightforward to exploit—a simple GET request to the unprotected endpoint will return the sensitive JSON data. Attackers could automate data collection across multiple vulnerable AVideo instances or continuously monitor a single instance for new analytics data.

Detection Methods for CVE-2026-33685

Indicators of Compromise

• Unusual or unexpected HTTP requests to /plugin/AD_Server/reports.json.php from external IP addresses
• High-volume access to the JSON reporting endpoint without corresponding authenticated admin sessions
• Requests to reports.json.php lacking session cookies or authentication tokens
• Access patterns showing systematic data harvesting from the AD_Server plugin endpoints

Detection Strategies

• Monitor web server access logs for unauthenticated requests to /plugin/AD_Server/reports.json.php
• Implement web application firewall (WAF) rules to alert on access to the vulnerable endpoint from untrusted sources
• Review authentication logs for correlation between admin sessions and AD_Server reporting endpoint access
• Deploy intrusion detection signatures to identify exploitation attempts against the unprotected JSON API

Monitoring Recommendations

• Enable detailed access logging for all AD_Server plugin endpoints
• Configure alerting for any access to reports.json.php without valid admin session tokens
• Implement rate limiting on reporting endpoints to detect automated scraping attempts
• Regularly audit access logs for patterns indicating unauthorized data extraction

How to Mitigate CVE-2026-33685

Immediate Actions Required

• Apply the security patch from commit daca4ffb1ce19643eecaa044362c41ac2ce45dde immediately
• Restrict network access to the AD_Server plugin endpoints using firewall rules until patching is complete
• Review access logs for evidence of prior exploitation and potential data exposure
• Consider temporarily disabling the AD_Server plugin if immediate patching is not feasible

Patch Information

WWBN has released a fix in commit daca4ffb1ce19643eecaa044362c41ac2ce45dde. This patch adds the missing User::isAdmin() authorization check to the reports.json.php endpoint, bringing it in line with the security controls already present on reports.php and getCSV.php. Organizations should update to a version containing this commit or apply the patch manually. For detailed information, review the GitHub Security Advisory and the commit implementing the fix.

Workarounds

• Block external access to /plugin/AD_Server/reports.json.php at the web server or firewall level
• Implement HTTP Basic Authentication or IP whitelisting for the vulnerable endpoint as a temporary measure
• Disable the AD_Server plugin entirely if advertising functionality is not critical to operations
• Deploy a reverse proxy rule to require authentication before forwarding requests to the JSON reporting endpoint

# Example: Block access to vulnerable endpoint in Apache .htaccess
<Files "reports.json.php">
    <RequireAll>
        Require ip 10.0.0.0/8
        Require ip 192.168.0.0/16
    </RequireAll>
</Files>