CVE-2026-33041

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes. If an attacker obtains password hashes from the database (via SQL injection, backup exposure, etc.), they can instantly crack them by comparing against pre-computed hashes from this endpoint. This endpoint eliminates the need for an attacker to reverse-engineer the hashing algorithm. Combined with the weak hash chain (md5+whirlpool+sha1, no salt by default), an attacker with access to database hashes can crack passwords extremely quickly. This issue was fixed in version 26.0.

• CWE-200

• https://github.com/WWBN/AVideo/commit/ea2efd04464560cca93c9ab48b445dbb944a4e46Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-px7x-gq96-rmp5Exploit, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33036fast-xml-parser allows users to process XML from JS object w…7.5
• CVE-2026-33037WWBN AVideo is an open source video platform. In versions 25…8.1
• CVE-2026-33038WWBN AVideo is an open source video platform. Versions 25.0 …8.1
• CVE-2026-33039WWBN AVideo is an open source video platform. In versions 25…8.6
• CVE-2026-3304Multer is a node.js middleware for handling `multipart/form-…7.5
• CVE-2026-33040libp2p-rust is the official rust language Implementation of …7.5
• CVE-2026-33042Parse Server is an open source backend that can be deployed …5.3
• CVE-2026-33043WWBN AVideo is an open source video platform. In versions 25…8.1
• CVE-2026-33044Home Assistant is open source home automation software that …5.4
• CVE-2026-33045Home Assistant is open source home automation software that …5.4
• CVE-2026-33046Indico is an event management system that uses Flask-Multipa…8.8
• CVE-2026-33051Craft CMS is a content management system (CMS). In versions …5.4