Exploit discussion active in current signal (1 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-03-27 | 1 | Disclosure1 |
| 2026-03-28 | 2 | Disclosure1General1 |
| 2026-03-29 | 1 | Disclosure1 |
🚨 AVideo PW Leak CVSS: 9.1 Admin credentials exposed in AVideo platform config files. Direct exposure allows unauthorized access to video management dashboards and content APIs. https://nvd.nist.gov/vuln/detail/CVE-2026-33867
Post summary
The post announces CVE-2026-33867, describing a CVSS 9.1 credential‑exposure flaw in AVideo platform configuration files that permits unauthorized dashboard access.
CVE-2026-33867 WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video pass… https://www.cve.org/CVERecord?id=CVE-2026-33867
Post summary
The post references CVE‑2026‑33867 and links to its CVE record but provides no substantive detail about the vulnerability.
🚨 CVE-2026-33867: AVideo has Plaintext Video Passw... Plaintext password storage in 2026? AVideo devs treating CWE-312 like it's optional while sitting on a 9.1 CVSS goldmin... https://zerodaysignal.com/vulnerability/CVE-2026-33867 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
AVideo is disclosed to have a high‑severity plaintext password storage flaw (CWE‑312, CVSS 9.1), with a link to a vulnerability page that likely provides further details.
`AVideo` contains a plaintext video password storage vulnerability (CVE-2026-33867), potentially exposing sensitive credentials. Assess #AVideo deployments for this #infosec risk. Review access controls. #CVE https://www.pulsepatch.io/posts/cve-2026-33867-avideo-plaintext-password-storage
Post summary
CVE-2026-33867 is a plaintext password storage flaw in AVideo, urging users to review deployments for risk mitigation.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wwbn | avideo | - | - | - |