CVE-2026-33763: WWBN AVideo Auth Bypass Vulnerability

CVE-2026-33763 Overview

WWBN AVideo is an open source video platform that contains a critical authentication weakness in versions up to and including 26.0. The get_api_video_password_is_correct API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean passwordIsCorrect field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords.

Critical Impact
Unauthenticated attackers can brute-force passwords for any password-protected video on AVideo platforms, potentially exposing sensitive or private video content without any access controls.

Affected Products

WWBN AVideo versions up to and including 26.0

Discovery Timeline

2026-03-27 - CVE CVE-2026-33763 published to NVD
2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33763

Vulnerability Analysis

This vulnerability represents a classic Improper Restriction of Excessive Authentication Attempts (CWE-307) flaw. The get_api_video_password_is_correct API endpoint was designed to validate video passwords but lacked fundamental security controls. The endpoint accepts a videos_id parameter and a password, returning a clear boolean response indicating whether the password matches—effectively providing an oracle that attackers can query repeatedly without consequence.

The attack can be executed entirely over the network without any prior authentication. An attacker only needs to know or enumerate video IDs to begin targeting password-protected content. The lack of rate limiting means automated tools can submit thousands of password attempts per minute, making dictionary attacks and brute-force attempts highly practical.

Root Cause

The root cause is the absence of rate limiting, authentication requirements, or CAPTCHA verification on the password validation endpoint. The API was implemented to provide a convenient password check mechanism but failed to account for abuse scenarios where unauthenticated users could repeatedly query the endpoint to enumerate valid passwords.

Attack Vector

The vulnerability is exploitable via network access with no prerequisites. An attacker can craft HTTP requests to the get_api_video_password_is_correct endpoint, iterating through password lists while observing the passwordIsCorrect response field. The attack requires:

Identifying or enumerating target video IDs
Sending repeated password validation requests to the API endpoint
Analyzing boolean responses to identify correct passwords
Accessing password-protected video content using discovered credentials

php

     )
     public function get_api_video_password_is_correct($parameters)
     {
+        $this->checkRateLimit('video_password_check', 10, 300); // 10 attempts per 5 minutes
 
         $obj = new stdClass();
         $obj->videos_id = intval($parameters['videos_id']);

Source: GitHub Commit

The patch introduces a rate limit of 10 attempts per 5 minutes for the password check functionality, significantly reducing the feasibility of brute-force attacks.

Detection Methods for CVE-2026-33763

Indicators of Compromise

High volume of requests to the get_api_video_password_is_correct API endpoint from single IP addresses
Rapid sequential requests with varying password parameters targeting the same videos_id
Access patterns showing enumeration behavior across multiple video IDs
Failed authentication attempts followed by successful video access from the same source

Detection Strategies

Monitor API endpoint access logs for the get_api_video_password_is_correct endpoint with anomaly detection
Implement alerting on request rates exceeding normal user behavior thresholds
Track unique IP addresses making repeated password validation requests
Correlate password check attempts with subsequent successful video access events

Monitoring Recommendations

Enable detailed logging for all API authentication-related endpoints
Deploy Web Application Firewall (WAF) rules to detect and block brute-force patterns
Set up real-time alerting for excessive failed password validation attempts
Monitor for automated tool signatures in User-Agent strings and request timing patterns

How to Mitigate CVE-2026-33763

Immediate Actions Required

Update WWBN AVideo to a version containing commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 or later
Review access logs for evidence of exploitation attempts against password-protected videos
Consider temporarily disabling password-protected video features if patching is not immediately possible
Reset passwords for sensitive password-protected videos that may have been compromised

Patch Information

The vulnerability is addressed in commit 01a0614fedcdaee47832c0d913a0fb86d8c28135. This patch implements rate limiting of 10 attempts per 5 minutes for the video password check functionality. For detailed information, refer to the GitHub Security Advisory and the patch commit.

Workarounds

Implement external rate limiting at the web server or reverse proxy level for API endpoints
Use a Web Application Firewall to block excessive requests to authentication endpoints
Restrict API endpoint access to authenticated users only via server configuration
Deploy IP-based blocking for sources exhibiting brute-force behavior

bash

# Example nginx rate limiting configuration for API endpoints
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/m;

location /plugin/API/ {
    limit_req zone=api_limit burst=5 nodelay;
    # existing configuration...
}