CVE-2026-33764: Wwbn Avideo Information Disclosure Flaw

CVE-2026-33764 Overview

WWBN AVideo is an open source video platform that contains an Insecure Direct Object Reference (IDOR) vulnerability in its AI plugin. In versions up to and including 26.0, the AI plugin's save.json.php endpoint loads AI response objects using an attacker-controlled $_REQUEST['id'] parameter without validating that the AI response belongs to the specified video. This authorization bypass allows authenticated users with AI permissions to access and exfiltrate AI-generated content from other users' private videos.

Critical Impact

An authenticated attacker can steal AI-generated titles, descriptions, keywords, summaries, or full transcriptions from any user's private videos by manipulating the AI response ID parameter.

Affected Products

• WWBN AVideo versions up to and including 26.0
• AVideo installations with the AI plugin enabled
• Self-hosted AVideo deployments with AI functionality

Discovery Timeline

• 2026-03-27 - CVE-2026-33764 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33764

Vulnerability Analysis

This vulnerability is classified as CWE-639: Authorization Bypass Through User-Controlled Key, commonly known as Insecure Direct Object Reference (IDOR). The flaw exists in the AI plugin's save.json.php endpoint, which processes AI-generated content for videos.

The endpoint accepts an id parameter through $_REQUEST['id'] that references AI response objects stored in the system. The fundamental security issue is that the application fails to verify whether the requesting user has authorization to access the specified AI response. This means any authenticated user with AI permissions can enumerate and access AI responses generated for other users' private videos.

The attack allows exfiltration of sensitive information including video titles, descriptions, keywords, summaries, and complete transcriptions that were AI-generated for private content belonging to other users.

Root Cause

The root cause is a missing authorization check in the save.json.php endpoint. When loading AI response objects, the application accepts the user-supplied id parameter directly without validating that:

1. The AI response belongs to a video owned by the requesting user
2. The requesting user has appropriate permissions to access the referenced AI response
3. The video associated with the AI response is publicly accessible

This violates the principle of proper access control, where object references should be validated against the authenticated user's permissions before granting access.

Attack Vector

The attack is network-based and requires an authenticated user account with AI plugin permissions. The attacker can exploit this vulnerability by:

1. Authenticating to the AVideo platform with valid credentials
2. Sending requests to the save.json.php endpoint with manipulated id values
3. Iterating through AI response IDs to discover content generated for other users' private videos
4. Applying the stolen AI-generated content (titles, descriptions, keywords, summaries, or transcriptions) to their own videos

The vulnerability exposes confidential information through horizontal privilege escalation, allowing users to access data belonging to other users at the same privilege level. Since AI-generated content often contains detailed summaries and full transcriptions, sensitive information from private videos can be completely compromised.

Detection Methods for CVE-2026-33764

Indicators of Compromise

• Unusual access patterns to the save.json.php endpoint with sequential or enumerated id parameters
• Single user accounts making requests for AI responses belonging to multiple different videos
• Sudden increases in AI plugin API calls from individual user sessions
• Log entries showing AI response IDs accessed that don't match the requesting user's video ownership

Detection Strategies

• Implement logging and monitoring for the save.json.php endpoint to track id parameter usage
• Deploy web application firewall (WAF) rules to detect parameter manipulation and enumeration attempts
• Enable audit logging for AI response access to correlate user sessions with video ownership
• Use anomaly detection to identify users accessing disproportionate numbers of AI responses

Monitoring Recommendations

• Monitor server logs for patterns indicating IDOR exploitation attempts on the AI plugin endpoints
• Set up alerts for failed authorization attempts or access to AI responses not owned by the requesting user
• Track user session behavior for signs of automated enumeration or scraping activity
• Review access logs periodically for unauthorized cross-user data access patterns

How to Mitigate CVE-2026-33764

Immediate Actions Required

• Update WWBN AVideo to a version containing commit aa2c46a806960a0006105df47765913394eec142 or later
• Review access logs for signs of exploitation prior to patching
• Consider temporarily disabling the AI plugin if immediate patching is not possible
• Audit user accounts with AI permissions to ensure appropriate access levels

Patch Information

WWBN has released a security patch in commit aa2c46a806960a0006105df47765913394eec142. This fix implements proper authorization validation to ensure users can only access AI responses associated with videos they own or have permission to access.

For detailed information about the vulnerability and patch, refer to the GitHub Security Advisory and the GitHub Commit.

Workarounds

• Disable the AI plugin entirely until the patch can be applied
• Restrict AI plugin permissions to only trusted administrator accounts
• Implement network-level access controls to limit who can reach the save.json.php endpoint
• Deploy a reverse proxy or WAF rule to validate AI response ownership before requests reach the application