CVE-2026-33759: Wwbn Avideo Auth Bypass Vulnerability

CVE-2026-33759 Overview

CVE-2026-33759 is an Insecure Direct Object Reference (IDOR) vulnerability affecting WWBN AVideo, an open source video platform. The vulnerability allows unauthenticated attackers to access the complete video contents of any playlist—including private playlists—by manipulating the playlists_id parameter in API requests to the objects/playlistsVideos.json.php endpoint.

While private playlists (including user-specific watch_later and favorite types) are properly hidden from listing endpoints via playlistsFromUser.json.php, the video contents endpoint lacks authentication and authorization checks, allowing direct enumeration and access through sequential integer IDs.

Critical Impact

Unauthenticated attackers can access private video content and user playlist data by enumerating sequential playlist IDs, potentially exposing sensitive or restricted video content across the entire platform.

Affected Products

• WWBN AVideo versions up to and including 26.0
• All AVideo installations using default configuration without external access controls
• Self-hosted AVideo instances with publicly accessible API endpoints

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33759 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33759

Vulnerability Analysis

This vulnerability represents a classic Insecure Direct Object Reference (IDOR) flaw where the application fails to verify that the requesting user has permission to access the requested resource. The playlistsVideos.json.php endpoint directly processes the playlists_id parameter without performing any authentication or authorization validation before returning playlist contents.

The core issue stems from an incomplete access control implementation—while the developers properly restricted playlist discovery through listing endpoints, they overlooked protecting the actual content retrieval endpoint. This creates a security gap where an attacker who knows or can guess a playlist ID gains full access to its contents regardless of the playlist's privacy settings.

Root Cause

The root cause involves two distinct issues in the AVideo codebase:

1. Missing Authorization Check: The playlistsVideos.json.php endpoint directly calls PlayList::getVideosFromPlaylist() without first verifying whether the requesting user has permission to view the playlist.

2. Variable Naming Typo: A secondary issue in the playlist.php file involved a typo where $playListCanSe was used instead of $playListCanSee, causing the permission caching mechanism to malfunction and potentially bypass visibility checks even when they were invoked.

Attack Vector

The attack is trivially exploitable over the network without authentication. An attacker simply sends HTTP requests to the vulnerable endpoint while incrementing the playlists_id parameter to enumerate all playlists on the platform:

GET /objects/playlistsVideos.json.php?playlists_id=1
GET /objects/playlistsVideos.json.php?playlists_id=2
GET /objects/playlistsVideos.json.php?playlists_id=3
...

Since playlist IDs are sequential integers, automated enumeration is straightforward and can quickly expose all private playlists including users' watch history and favorites.

The security patch addresses this by adding proper authorization checks:

$_playlists_id = (int)$_REQUEST['playlists_id'];
if (!PlayList::canSee($_playlists_id, User::getId())) {
    http_response_code(403);
    die(json_encode(['error' => 'You do not have permission to view this playlist']));
}
$videos = PlayList::getVideosFromPlaylist($_playlists_id);

Source: GitHub Commit Reference

The patch also corrects the variable naming issue in the permission check function:

global $playListCanSee;
$index = "$playlist_id, $users_id";
if (isset($playListCanSee[$index])) {
    return $playListCanSee[$index];
}
$playListCanSee[$index] = true;
$obj = new PlayList($playlist_id);
$status = $obj->getStatus();
if ($status !== 'public' && $status !== 'unlisted' && $users_id !== $obj->getUsers_id()) {
    $playListCanSee[$index] = false;
}
return $playListCanSee[$index];

Source: GitHub Commit Reference

Detection Methods for CVE-2026-33759

Indicators of Compromise

• Unusual volume of requests to /objects/playlistsVideos.json.php from single IP addresses
• Sequential or enumeration patterns in playlists_id parameter values in web server logs
• Requests to the playlist videos endpoint from unauthenticated sessions accessing non-public playlists
• Automated scanning tools targeting API endpoints with incrementing integer parameters

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block rapid sequential parameter enumeration
• Monitor access logs for patterns of requests iterating through numeric ID values
• Deploy rate limiting on API endpoints to slow down enumeration attempts
• Enable application-level logging to track unauthorized access attempts to private playlists

Monitoring Recommendations

• Configure alerts for high-frequency requests to the playlistsVideos.json.php endpoint
• Review web server access logs for requests returning playlist data without corresponding session authentication
• Monitor for unusual data exfiltration patterns from the video platform
• Implement anomaly detection for API access patterns that deviate from normal user behavior

How to Mitigate CVE-2026-33759

Immediate Actions Required

• Update WWBN AVideo to a version containing commit bb716fbece656c9fe39784f11e4e822b5867f1ca or later
• Review web server logs for evidence of prior exploitation or enumeration attempts
• Audit all API endpoints for similar IDOR vulnerabilities
• Consider implementing additional access controls at the web server or reverse proxy level

Patch Information

WWBN has released a security patch addressing this vulnerability. The fix is available in commit bb716fbece656c9fe39784f11e4e822b5867f1ca. Organizations running affected versions should apply this patch immediately. For detailed information, refer to the GitHub Security Advisory.

Workarounds

• Implement authentication requirements at the web server level (nginx/Apache) for all /objects/ API endpoints
• Deploy a Web Application Firewall (WAF) rule to block unauthenticated requests to sensitive API endpoints
• Restrict access to the AVideo API to trusted IP ranges or authenticated users only
• Use a reverse proxy to add authentication layers in front of vulnerable endpoints

# Example nginx configuration to require authentication for API endpoints
location /objects/ {
    auth_basic "Restricted Access";
    auth_basic_user_file /etc/nginx/.htpasswd;
    
    # Rate limiting to prevent enumeration
    limit_req zone=api_limit burst=10 nodelay;
    
    proxy_pass http://avideo_backend;
}