ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33688

WWBN AVideo is an open source video platform.

Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses. Commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157 contains a patch.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 23, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three disti

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three disti

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33688

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33688

    WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerat

    nvd.nist.gov

References