CVE-2026-33685: 
PHP vulnerability analysis and mitigation

CVE-2026-33685 is an unauthenticated information disclosure vulnerability in WWBN AVideo, an open source video platform. The plugin/AD_Server/reports.json.php endpoint performs no authentication or authorization checks, allowing any unauthenticated remote attacker to extract ad campaign analytics data including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. All versions up to and including 26.0 are affected. The vulnerability was published on March 23, 2026, with a patch committed the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, GHSA Advisory).

The root cause is a missing authorization check (CWE-862) in plugin/AD_Server/reports.json.php. While the file loads the application configuration (videos/configuration.php), it never invokes User::isAdmin() to verify the requester's identity — an inconsistency with the HTML counterpart (reports.php) and CSV export (getCSV.php), both of which correctly enforce admin-only access. The same oversight affected getData.json.php, view/campaigns.json.php, and view/campaignsVideos.json.php. Exploitation requires only a standard HTTP GET request with no credentials, making it trivially accessible over the network (GHSA Advisory, Patch Commit).

Successful exploitation results in unauthorized disclosure of ad campaign analytics data, including video titles, user channel names, user IDs, ad campaign names, and impression/click counts. The exposed user IDs and channel names could facilitate targeted attacks such as account enumeration or social engineering. There is no integrity or availability impact; the vulnerability is limited to confidentiality loss (GitHub Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, consisting of ready-to-execute curl commands targeting the vulnerable endpoint (e.g., curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsByVideo') and an enumeration loop over user IDs. No authentication or special conditions are required, making exploitation trivial. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.112% (GHSA Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the target's web interface.
2. Probe the vulnerable endpoint: Send an unauthenticated HTTP GET request to the unprotected JSON API:

   curl -s 'https://target/plugin/AD_Server/reports.json.php?reportType=adsByVideo'

3. Extract ad campaign analytics: Review the JSON response, which returns video titles, ad campaign names, and impression/click counts without requiring any credentials.
4. Enumerate user data: Iterate over user IDs to extract user channel names and associated analytics:

   for i in $(seq 1 20); do curl -s "https://target/plugin/AD_Server/reports.json.php?reportType=adsByUser&users_id=$i"; done

5. Leverage disclosed data: Use harvested user IDs and channel names for further reconnaissance, account enumeration, or targeted social engineering attacks (GHSA Advisory).

• Network: Unauthenticated HTTP GET requests to /plugin/AD_Server/reports.json.php, /plugin/AD_Server/getData.json.php, /plugin/AD_Server/view/campaigns.json.php, or /plugin/AD_Server/view/campaignsVideos.json.php from external or unexpected IP addresses.
• Logs: Web server access logs showing repeated requests to the above endpoints with reportType query parameters (e.g., reportType=adsByVideo, reportType=adsByUser) from unauthenticated sessions; sequential users_id parameter values indicating enumeration attempts.
• Network: Rapid sequential requests with incrementing users_id values (e.g., users_id=1 through users_id=N) suggesting automated enumeration scripts (GHSA Advisory).

The fix is available in commit daca4ffb1ce19643eecaa044362c41ac2ce45dde, which adds User::isAdmin() checks to reports.json.php, getData.json.php, campaigns.json.php, and campaignsVideos.json.php. Users should update their AVideo installation to a version incorporating this patch (released after March 23, 2026). As an interim workaround for unpatched systems, restrict network access to the affected endpoints via firewall rules or web server access control lists (e.g., deny external access to /plugin/AD_Server/*.json.php). Alternatively, implement authentication requirements at the web server level (e.g., HTTP Basic Auth) until the patch can be applied (Patch Commit, GHSA Advisory).