CVE-2026-33867

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.

• CWE-312

• https://github.com/WWBN/AVideo/commit/f2d68d2adbf73588ea61be2b781d93120a819e36Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wgExploit, Vendor Advisory
• https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wgExploit, Vendor Advisory

Published

Mar 27, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-33857Out-of-bounds Read vulnerability in mod_proxy_ajp of Apach…5.3
• CVE-2026-33858Dag Authors, who normally should not be able to execute code…8.8
• CVE-2026-3386A flaw has been found in wren-lang wren up to 0.4.0. Affecte…7.1
• CVE-2026-33862A vulnerability has been identified in Teamcenter V2312 (All…6.1
• CVE-2026-33865MLflow is vulnerable to Stored Cross-Site Scripting (XSS) ca…5.4
• CVE-2026-33866MLflow is vulnerable to an authorization bypass affecting th…4.3
• CVE-2026-33868Mastodon is a free, open-source social network server based …6.1
• CVE-2026-33869Mastodon is a free, open-source social network server based …4.8
• CVE-2026-3387A vulnerability has been found in wren-lang wren up to 0.4.0…5.5
• CVE-2026-33870Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-33871Netty is an asynchronous, event-driven network application f…7.5
• CVE-2026-33872elixir-nodejs provides an Elixir API for calling Node.js fun…7.1