CVE-2026-33867: Wwbn Avideo Information Disclosure Flaw

CVE-2026-33867 Overview

CVE-2026-33867 is a cleartext storage vulnerability in WWBN AVideo, an open source video platform. The flaw affects all versions up to and including 26.0. AVideo lets content owners password-protect individual videos, but the platform stores these passwords in the database without hashing, salting, or encryption. Any attacker who gains read access to the database — through SQL injection, an exposed backup, or misconfigured permissions — recovers every video password in plaintext. The issue is tracked under CWE-312: Cleartext Storage of Sensitive Information. A fix is available in commit f2d68d2adbf73588ea61be2b781d93120a819e36.

Critical Impact
Database read access exposes every protected video password, bypassing the platform's content access controls.

Affected Products

WWBN AVideo versions up to and including 26.0
Self-hosted AVideo deployments using the built-in video password feature
Backups and replicas containing the AVideo database

Discovery Timeline

2026-03-27 - CVE-2026-33867 published to NVD
2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-33867

Vulnerability Analysis

AVideo offers a per-video password feature so creators can restrict access to specific uploads. The platform persists these passwords directly to its database in cleartext rather than applying a one-way hash or authenticated encryption. Any code path or actor that reads the relevant table receives the original password value.

This design conflates a confidentiality boundary (the database) with an access control boundary (the video password). The video password is intended as a shared secret between the content owner and approved viewers. Storing it in plaintext means the database becomes a single point of compromise for that secret across every protected video on the instance.

The impact extends beyond AVideo itself. Users frequently reuse passwords, so leaked video passwords can be tested against email accounts, streaming services, and other applications belonging to viewers or content owners.

Root Cause

The root cause is missing protection of stored credentials. The application writes the password field as supplied without invoking a password hashing function such as password_hash() with bcrypt or Argon2. The patch in commit f2d68d2adbf73588ea61be2b781d93120a819e36 updates the storage and verification flow so passwords are hashed before persistence and compared with a constant-time verification routine.

Attack Vector

Exploitation requires read access to the AVideo database. Realistic paths include a SQL injection flaw elsewhere in the application or a downstream plugin, an exposed or stolen database backup (mysqldump files, snapshots in object storage), a misconfigured database service exposed to the internet, or a compromised hosting account with shared database credentials. Once the attacker dumps the video records table, every video password is immediately usable to authenticate to protected videos without further cracking effort.

The vulnerability mechanism is described in the GitHub Security Advisory GHSA-363v-5rh8-23wg and addressed by the upstream patch commit.

Detection Methods for CVE-2026-33867

Indicators of Compromise

Unexpected SELECT queries targeting the videos table from application or administrative accounts
Database export operations (mysqldump, SELECT ... INTO OUTFILE) outside scheduled backup windows
Access to password-protected videos from IP addresses or user agents that never authenticated through normal flows
Outbound transfer of large database dumps from the AVideo host

Detection Strategies

Inspect database audit logs for read access to the video records table by non-application accounts
Correlate web server logs with successful protected-video views to identify viewers bypassing the password prompt
Hunt for SQL injection probes in HTTP logs targeting AVideo endpoints that accept query parameters
Verify the running AVideo version against 26.0 and confirm whether commit f2d68d2adbf73588ea61be2b781d93120a819e36 is applied

Monitoring Recommendations

Enable MySQL or MariaDB general query logging or audit plugins on the AVideo database
Alert on database backup files appearing in publicly reachable directories or storage buckets
Monitor for credential stuffing attempts against user accounts that reuse video passwords
Track schema changes to confirm the patched hashed-password column is in use after upgrade

How to Mitigate CVE-2026-33867

Immediate Actions Required

Upgrade AVideo to a release that includes commit f2d68d2adbf73588ea61be2b781d93120a819e36
Rotate every existing video password after upgrade, since prior values must be assumed exposed
Audit database backups stored on disk or in cloud storage and re-encrypt or delete those containing plaintext passwords
Review database accounts and remove read permissions that are not required by the application

Patch Information

The upstream fix is published in commit f2d68d2adbf73588ea61be2b781d93120a819e36 and described in GHSA-363v-5rh8-23wg. The patch replaces plaintext storage with a hashed representation and updates the verification path accordingly. Administrators must force a password reset for protected videos because legacy values cannot be migrated into the new hashed format.

Workarounds

Restrict the AVideo database to localhost or a private network segment and block external connections
Apply least-privilege database grants so only the AVideo service account can read the videos table
Encrypt database backups at rest and store them in access-controlled locations with audit logging
Until patched, avoid relying on the video password feature for sensitive content and use account-based access controls instead

bash

# Configuration example: restrict MySQL bind address and tighten grants
# /etc/mysql/mysql.conf.d/mysqld.cnf
bind-address = 127.0.0.1

# Limit application user privileges
REVOKE ALL PRIVILEGES ON avideo.* FROM 'avideo_app'@'%';
GRANT SELECT, INSERT, UPDATE, DELETE ON avideo.* TO 'avideo_app'@'localhost';
FLUSH PRIVILEGES;