ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33292

WWBN AVideo is an open source video platform.

Published Mar 22, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint ( ) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The GET parameter is used in two divergent code paths — one for authorization (which truncates at the first segment) and one for file access (which preserves traversal sequences) — creating a split-oracle condition where authorization is checked against one video while content is served from another. Version 26.0 contains a fix for the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 22, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint ( ) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The GET parameter is used in two divergent code paths — one for authorization (which truncates at the first segment) and one for file access (which preserves traversa

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint ( ) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The GET parameter is used in two divergent code paths — one for authorization (which truncates at the first segment) and one for file access (which preserves traversa

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33292

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33292

    WWBN AVideo is an open source video platform. Prior to version 26.0, the HLS streaming endpoint ( ) is vulnerable to a path traversal attack that allows an unauthenticated attacker to stream any private or paid video on the platform. The GET paramete

    nvd.nist.gov

References