CVE-2026-33512CWE-287CWE-312CWE-326CWE-327

AVideo has an unauthenticated decrypt oracle leaking any ciphertext

High · published March 23, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
24.8
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Commit 3fdeecef37bb88967a02ccc9b9acc8da95de1c13 contains a patch.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00329 · 24.8th percentile
Weaknesses
CWE-287 · Improper Authentication; CWE-312 · Cleartext Storage of Sensitive Information; CWE-326 · Inadequate Encryption Strength; CWE-327 · Use of a Broken or Risky Cryptographic Algorithm
Published
2026-03-23T18:17Z
EPSS history
Timeline
  • 23 MAR 18:17Z
    AVideo has an unauthenticated decrypt oracle leaking any ciphertext
    cvelistv5