CVE-2026-33716
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at accepts a user-supplied parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns , completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence. Commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at accepts a user-supplied parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns , completely bypassing authentication. This grants unauthenticated control over
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at accepts a user-supplied parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns , completely bypassing authentication. This grants unauthenticated control over
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33716
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33716
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at accepts a user-supplied parameter that overrides where the server sends token verificati
nvd.nist.gov