ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33485

WWBN AVideo is an open source video platform.

Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP callback at is accessible without authentication. The parameter (stream key) is interpolated directly into SQL queries in two locations — and — without parameterized binding or escaping. An unauthenticated attacker can exploit time-based blind SQL injection to extract all database contents including user password hashes, email addresses, and other sensitive data. Commit af59eade82de645b20183cc3d74467a7eac76549 contains a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 23, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP callback at is accessible without authentication. The parameter (stream key) is interpolated directly into SQL queries in two locations — and — without parameterized binding or escaping. An unauthenticated attacker can exploit time-based blind SQL injection to extract all database contents including user p

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP callback at is accessible without authentication. The parameter (stream key) is interpolated directly into SQL queries in two locations — and — without parameterized binding or escaping. An unauthenticated attacker can exploit time-based blind SQL injection to extract all database contents including user p

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33485

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33485

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the RTMP callback at is accessible without authentication. The parameter (stream key) is interpolated directly into SQL queries in two lo

    nvd.nist.gov

References