ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33297

WWBN AVideo is an open source video platform.

Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. Prior to version 26.0, the endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended password, the stored channel password becomes 0, which any visitor can trivially guess to bypass channel-level access control. Version 26.0 contains a patch for the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 23, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. Prior to version 26.0, the endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended passwo

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. Prior to version 26.0, the endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password containing non-numeric characters is silently coerced to the integer zero before being stored. This means that regardless of the intended passwo

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33297

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33297

    WWBN AVideo is an open source video platform. Prior to version 26.0, the endpoint in the CustomizeUser plugin allows administrators to set a channel password for any user. Due to a logic error in how the submitted password value is processed, any password c

    nvd.nist.gov

References