CVE-2026-33488

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `createKeys()` function in the LoginControl plugin's PGP 2FA system generates 512-bit RSA keys, which have been publicly factorable since 1999. An attacker who obtains a target user's public key can factor the 512-bit RSA modulus on commodity hardware in hours, derive the complete private key, and decrypt any PGP 2FA challenge issued by the system — completely bypassing the second authentication factor. Additionally, the `generateKeys.json.php` and `encryptMessage.json.php` endpoints lack any authentication checks, exposing CPU-intensive key generation to anonymous users. Commit 00d979d87f8182095c8150609153a43f834e351e contains a patch.

• CWE-326

• https://github.com/WWBN/AVideo/commit/00d979d87f8182095c8150609153a43f834e351ePatch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6m5f-j7w2-w953Exploit, Mitigation, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-6m5f-j7w2-w953Exploit, Mitigation, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33482WWBN AVideo is an open source video platform. In versions up…8.1
• CVE-2026-33483WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33484Langflow is a tool for building and deploying AI-powered age…7.5
• CVE-2026-33485WWBN AVideo is an open source video platform. In versions up…7.5
• CVE-2026-33486Roadiz is a polymorphic content management system based on a…6.5
• CVE-2026-33487goxmlsig provides XML Digital Signatures implemented in Go. …7.5
• CVE-2026-33489CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-3349The MinhNhut Link Gateway plugin for WordPress is vulnerable…6.1
• CVE-2026-33490H3 is a minimal H(TTP) framework. In versions 2.0.0-0 throug…5.3
• CVE-2026-33491Zen C is a systems programming language that compiles to hum…7.8
• CVE-2026-33492WWBN AVideo is an open source video platform. In versions up…7.3
• CVE-2026-33493WWBN AVideo is an open source video platform. In versions up…8.1