CVE-2026-33688 json
AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint
published 2026-03-23 7 mo ago modified 2026-06-17 4 mo ago also EUVD-2026-14498 , GHSA-m99f-mmvg-3xmx
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 20%
- public exploits
- 0
- none known
Summary
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses. Commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157 contains a patch.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <=26.0 |
no fix listed |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-204 Observable Response Discrepancy
References
-
github.com
/WWBN/AVideo/commit/e42f54123b460fd1b2ee01f2ce3d4a386e88d157
web, patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33688
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-33688
- GitHub Advisory GHSA-m99f-mmvg-3xmx
- NVD CVE-2026-33688
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.