Raw vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:XSummary
CVE-2026-33297 is a medium-severity Authorization Bypass Through User-Controlled Key (CWE-639) vulnerability in Wwbn Avideo. Its CVSS base score is 5.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-24 (Access Control Decisions) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-33297 affects WWBN AVideo, an open source video platform, in versions prior to 26.0. The vulnerability resides in the `setPassword.json.php` endpoint of the CustomizeUser plugin, which administrators use to set channel passwords for users. A logic error causes any submitted password containing non-numeric characters to be silently coerced to the integer zero before storage, rendering all channel passwords effectively "0" regardless of the administrator's intent. This flaw, classified under CWE-639 (Authorization Bypass Through User-Controlled Key), has a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N).
The vulnerability enables unauthenticated attackers with network access to trivially bypass channel-level access controls by guessing the password "0". No special privileges, user interaction, or complex conditions are required, allowing remote exploitation over the network with low attack complexity. Successful exploitation grants unauthorized access to protected video channels, resulting in high impacts on confidentiality (e.g., viewing restricted content) and integrity (e.g., potential tampering with channel data).
Version 26.0 of AVideo patches the issue, as detailed in the GitHub commit (https://github.com/WWBN/AVideo/commit/7a6a94631a0a18c313894395e6eb6703cca4abd0) and the associated security advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-6547-8hrg-c55m). Security practitioners should upgrade to version 26.0 or later and audit existing channel configurations for the default zero password.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-14429
Vulnerability Data
WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value…
more
is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control. Version 26.0 contains a patch for the issue.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Enforcing approved authorizations on every access request structurally stops a user-controlled key from reaching another user's data.
Requiring explicit access-control decisions on each request blocks unauthorized key-driven access.
Least-privilege restrictions limit the scope of data reachable even if a key check is bypassed.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Enforcing authorization policy and least privilege directly blocks user-controlled key tampering that bypasses access checks.
Logical access controls prevent unauthorized data access that results from missing authorization checks on object references.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect missing authorization checks but does not prevent the weakness in production.
Information access restriction explicitly enforces that users may only retrieve data they are authorized to see, directly addressing user-controlled key bypass.
Access control policy directly requires enforcement of authorization rules that prevent unauthorized access via manipulated keys.
Managing access rights includes ensuring users can only access their own records and not bypass authorization by altering identifiers.
Privileged access rights control restricts what data each user may access, mitigating direct object reference attacks.
Secure development lifecycle includes authorization design but does not itself implement runtime access checks.