CVE-2026-33716

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at `plugin/Live/standAloneFiles/control.json.php` accepts a user-supplied `streamerURL` parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns `{"error": false}`, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence. Commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch.

• CWE-287

• https://github.com/WWBN/AVideo/commit/388fcd57dbd16f6cb3ebcdf1d08cf2b929941128Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-9hv9-gvwm-95f2Exploit, Vendor Advisory

Published

Mar 23, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33710Chamilo LMS is a learning management system. Prior to 1.11.3…7.5
• CVE-2026-33711Incus is a system container and virtual machine manager. Inc…7.8
• CVE-2026-33712Typebot is a chatbot builder tool. In versions 3.15.2 and pr…10
• CVE-2026-33713n8n is an open source workflow automation platform. Prior to…8.8
• CVE-2026-33714Chamilo is an open-source learning management system (LMS). …7.2
• CVE-2026-33715Chamilo LMS is an open-source learning management system. In…7.2
• CVE-2026-33717WWBN AVideo is an open source video platform. In versions up…8.8
• CVE-2026-33718OpenHands is software for AI-driven development. Starting in…9.9
• CVE-2026-33719WWBN AVideo is an open source video platform. In versions up…8.6
• CVE-2026-33720n8n is an open source workflow automation platform. Prior to…4.2
• CVE-2026-33721MapServer is a system for developing web-based GIS applicati…7.5
• CVE-2026-33722n8n is an open source workflow automation platform. Prior to…5.3