CVE-2026-33867: Wwbn Avideo Information Disclosure Issue

CVE-2026-33867 Overview

WWBN AVideo is an open source video platform that allows content owners to password-protect individual videos. A critical cleartext storage vulnerability exists in versions up to and including 26.0 where video passwords are stored in the database without any cryptographic protection — no hashing, salting, or encryption is applied. If an attacker gains read access to the database through SQL injection, a database backup, or misconfigured access controls, they can obtain all video passwords in cleartext, potentially exposing protected content across the entire platform.

Critical Impact

Attackers with database access can retrieve all video passwords in plaintext, enabling unauthorized access to password-protected video content across the entire AVideo installation.

Affected Products

• WWBN AVideo versions up to and including 26.0
• All AVideo installations using password-protected video functionality
• Self-hosted AVideo deployments with database exposure risks

Discovery Timeline

• 2026-03-27 - CVE CVE-2026-33867 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33867

Vulnerability Analysis

This vulnerability falls under CWE-312 (Cleartext Storage of Sensitive Information). The AVideo platform's video password protection feature stores credentials directly in the database video_password column without any cryptographic transformation. This architectural flaw means that any database compromise immediately exposes all protected content credentials.

The vulnerability requires an attacker to first gain database read access, which can occur through various attack vectors including SQL injection vulnerabilities elsewhere in the application, compromised database backups, misconfigured database access controls, or insider threats with database access. Once database access is obtained, the attacker can directly query the videos table to extract all video passwords and use them to access protected content.

Root Cause

The root cause is the storage of sensitive authentication data (video passwords) in plaintext within the database. The original implementation used a VARCHAR(45) column that stored raw password strings without applying industry-standard password protection mechanisms such as bcrypt hashing with proper salting.

Attack Vector

The attack is network-accessible and requires an attacker to first compromise database access through a secondary vulnerability or misconfiguration. The attacker can then execute a simple SQL query to retrieve all video passwords:

-- Attacker query after gaining database access
SELECT id, title, video_password FROM videos WHERE video_password IS NOT NULL;

The patch implemented bcrypt password hashing and expanded the database column to accommodate the longer hash values:

-- Database schema change from patch
-  `video_password` VARCHAR(45) NULL DEFAULT NULL,
+  `video_password` VARCHAR(255) NULL DEFAULT NULL,

Source: GitHub Commit Details

The version update in the patch indicates the security improvements:

-$installationVersion = "28.0";
+$installationVersion = "29.0";

require_once '../objects/functionsSecurity.php';

Source: GitHub Commit Details

Detection Methods for CVE-2026-33867

Indicators of Compromise

• Unusual database queries targeting the videos table, particularly queries selecting the video_password column
• Evidence of SQL injection attempts in application logs that may indicate attempts to extract password data
• Unauthorized access to password-protected videos without corresponding authentication events
• Database backup files accessed or exfiltrated from backup storage locations

Detection Strategies

• Implement database activity monitoring to detect bulk queries against the videos table selecting password columns
• Monitor for SQL injection attack patterns in web application firewall (WAF) logs and application logs
• Enable audit logging on database servers to track all SELECT queries involving sensitive columns
• Review access logs for password-protected videos to identify access patterns that bypass normal authentication flows

Monitoring Recommendations

• Deploy SentinelOne Singularity to monitor for suspicious database access patterns and potential SQL injection exploitation
• Configure database query logging and alert on queries extracting multiple video_password values
• Implement file integrity monitoring on database backup storage to detect unauthorized access
• Establish baseline access patterns for password-protected content and alert on anomalies

How to Mitigate CVE-2026-33867

Immediate Actions Required

• Update WWBN AVideo to version 29.0 or later which includes the bcrypt password hashing fix
• Review database access controls and ensure the database server is not exposed to untrusted networks
• Audit existing database backups and ensure they are encrypted and access-controlled
• After upgrading, require all video content owners to reset their video passwords to ensure they are stored with proper hashing

Patch Information

The vulnerability has been addressed in commit f2d68d2adbf73588ea61be2b781d93120a819e36. This patch implements bcrypt password hashing for video passwords and expands the database column from VARCHAR(45) to VARCHAR(255) to accommodate the longer hash values. Users should update to AVideo version 29.0 or later. For detailed patch information, see the GitHub Security Advisory GHSA-363v-5rh8-23wg.

Workarounds

• Restrict database access to only trusted application servers using firewall rules and database authentication
• If unable to upgrade immediately, consider disabling the video password protection feature until the patch can be applied
• Implement network segmentation to isolate the database server from direct network access
• Enable encryption at rest for the database to provide an additional layer of protection for stored data

# Configuration example - Restrict MySQL access to localhost only
# Edit /etc/mysql/mysql.conf.d/mysqld.cnf
bind-address = 127.0.0.1

# Ensure database backups are encrypted
mysqldump -u root -p avideo_db | gpg --encrypt -r admin@example.com > avideo_backup.sql.gpg