CVE-2026-33690

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `getRealIpAddr()` function in `objects/functions.php` trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging. Commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c contains a patch.

• CWE-348

• https://github.com/WWBN/AVideo/commit/1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6cPatch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-8p2x-5cpm-qrqwExploit, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33685WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33686Sharp is a content management framework built for Laravel as…8.8
• CVE-2026-33687Sharp is a content management framework built for Laravel as…8.8
• CVE-2026-33688WWBN AVideo is an open source video platform. In versions up…5.3
• CVE-2026-33689xrdp is an open source RDP server. Versions through 0.10.5 h…9.1
• CVE-2026-3369The Better Find and Replace – AI-Powered Suggestions plugin …5.4
• CVE-2026-33691The OWASP core rule set (CRS) is a set of generic attack det…7.5
• CVE-2026-33692WWBN AVideo is an open source video platform. Versions prior…7.5
• CVE-2026-33693Lemmy is a link aggregator and forum for the fediverse. Prio…6.5
• CVE-2026-33694This vulnerability allows an attacker to create a junction, …7.4
• CVE-2026-33696n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33697Cocos AI is a confidential computing system for AI. The curr…6.3