Cyber Resilience

CVE-2026-33488

Crypto Weakness in Wwbn Avideo ≤ 26.0

Public PoCCrypto Weakness
Published
23 March 2026
Modified
24 March 2026
Patch / advisory
CVSS Score v3.1 7.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
EPSS Score 0.0025 17th percentile
Risk Priority 54 floored blend · peak EPSS

Summary

CVE-2026-33488 is a high-severity Inadequate Encryption Strength (CWE-326) vulnerability in Wwbn Avideo. Its CVSS base score is 7.4 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to SC-13 (Cryptographic Protection) and SC-12 (Cryptographic Key Establishment and Management) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-33488 affects WWBN AVideo, an open source video platform, in versions up to and including 26.0. The core issue lies in the LoginControl plugin's PGP 2FA system, where the createKeys() function generates 512-bit RSA keys, which have been publicly factorable since 1999 due to their inadequate size. This weakness allows the RSA modulus to be broken on commodity hardware. Additionally, the generateKeys.json.php and encryptMessage.json.php endpoints perform CPU-intensive operations without any authentication checks, exposing them to abuse by anonymous users.

Remote unauthenticated attackers (PR:N) can exploit this over the network (AV:N), though it requires high attack complexity (AC:H). By obtaining a target user's public key, an attacker can factor the modulus in hours, derive the full private key, and decrypt any PGP 2FA challenge, completely bypassing the second authentication factor and potentially gaining unauthorized account access (C:H/I:H). The exposed endpoints also enable resource exhaustion attacks, such as denial of service via repeated key generation requests. The vulnerability carries a CVSS v3.1 base score of 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) and is associated with CWE-326 (Inadequate Encryption Strength).

Mitigation is available via commit 00d979d87f8182095c8150609153a43f834e351e, which patches the weak key generation and addresses the unauthenticated endpoints. The GitHub security advisory GHSA-6m5f-j7w2-w953 provides further details on the issue and remediation steps. Security practitioners should urge AVideo administrators to apply this patch promptly.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the LoginControl plugin's PGP 2FA system generates 512-bit RSA keys, which have been publicly factorable since 1999. An attacker who obtains…

more

a target user's public key can factor the 512-bit RSA modulus on commodity hardware in hours, derive the complete private key, and decrypt any PGP 2FA challenge issued by the system — completely bypassing the second authentication factor. Additionally, the `generateKeys.json.php` and `encryptMessage.json.php` endpoints lack any authentication checks, exposing CPU-intensive key generation to anonymous users. Commit 00d979d87f8182095c8150609153a43f834e351e contains a patch.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1110 Brute Force Credential Access
Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
T1557 Adversary-in-the-Middle Credential Access
Adversaries may attempt to position themselves between two or more networked devices using an adversary-in-the-middle (AiTM) technique to support follow-on behaviors such as [Network Sniffing](https://attack.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-33512Same product: Wwbn Avideo
CVE-2023-50172Same product: Wwbn Avideo
CVE-2026-40935Same product: Wwbn Avideo
CVE-2026-41056Same product: Wwbn Avideo
CVE-2023-49599Same product: Wwbn Avideo
CVE-2026-33043Same product: Wwbn Avideo
CVE-2023-49589Same product: Wwbn Avideo
CVE-2020-37172Same product: Wwbn Avideo
CVE-2020-37158Same product: Wwbn Avideo
CVE-2023-49810Same product: Wwbn Avideo

Affected Assets

wwbn
avideo
≤ 26.0

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

Detect
Catch it (NIST detect / respond)

Harden
Shrink the surface (DISA STIG)
  • 14 hardening rules · 7 OS baselines
Validate
Prove the fix (OWASP ASVS)
  • V11.4.2
  • V14.1.2
  • V14.2.4

Mitigating Controls (NIST 800-53 r5) AI

SC-13 requires selection and implementation of specific cryptographic algorithms and key lengths, directly preventing use of inadequate encryption strength.

SC-12 governs cryptographic key establishment and management, which can enforce sufficient key sizes and thereby reduce inadequate encryption strength.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.DS-01 mostly match
prevents

Strong encryption is required to protect confidentiality of data-at-rest.

PR.DS-02 mostly match
prevents

Strong encryption is required to protect confidentiality of data-in-transit.

PR.PS-01 partial match
prevents

Hardened baselines can enforce minimum cryptographic algorithm and key-length settings.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Requiring the organization to define and enforce minimum cryptographic strength prevents deployment of insufficient key lengths or weak ciphers that can be brute-forced.

Hardening callouts derived

Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).

Oracle Linux 9 (1 rule)
  • V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-326
RHEL 8 (1 rule)
  • V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-326
RHEL 9 (1 rule)
  • V-257879 RHEL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-326
Windows Server 2016 (1 rule)
  • V-224843 Systems requiring data at rest protections must employ cryptographic mechanisms to prevent unauthorized disclosure and modification of the information at rest. prevents CWE-326

References