CVE-2026-33690: 
PHP vulnerability analysis and mitigation

CVE-2026-33690 is an IP address spoofing vulnerability in WWBN AVideo, an open source video platform, caused by the getRealIpAddr() function in objects/functions.php blindly trusting user-controlled HTTP headers to determine the client's IP address. It affects all versions up to and including 26.0. The vulnerability was published on March 23, 2026, with a patch committed the same day. It carries a CVSS v3.1 base score of 5.3 (Medium) (Github Advisory, GHSA Advisory).

The root cause is classified as CWE-348 (Use of Less Trusted Source): the getRealIpAddr() function iterates over a list of HTTP headers — HTTP_X_REAL_IP, HTTP_CLIENT_IP, HTTP_X_FORWARDED_FOR, and REMOTE_ADDR — and returns the first valid IPv4 address found, without verifying whether the request actually passed through a trusted proxy. Because HTTP headers such as X-Client-IP, X-Real-IP, and X-Forwarded-For are fully attacker-controlled, any unauthenticated remote attacker can inject an arbitrary IP value. No authentication or special preconditions are required; the attacker simply includes a forged header in any HTTP request to the target server. A proof-of-concept is publicly available in the security advisory (GHSA Advisory).

Successful exploitation allows an unauthenticated attacker to make the server believe requests originate from any arbitrary IP address, including localhost (127.0.0.1) or trusted internal ranges. This enables bypassing IP-based rate limiting, IP-based access controls, and DDoS captcha mechanisms, as well as forging audit log entries to obscure attacker activity. If the application grants elevated privileges to localhost or specific IP ranges, exploitation could lead to privilege escalation. Confidentiality and availability are not directly impacted, but integrity of access control and audit logging is undermined (GHSA Advisory, Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating exploitation with a single curl command using a forged X-Client-IP header. The EPSS score is approximately 0.014–0.029% (9th percentile), indicating low current exploitation probability. There is no evidence of in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (GHSA Advisory, Github Advisory).

1. Reconnaissance: Identify internet-facing WWBN AVideo instances running version 26.0 or earlier using search engines like Shodan or Censys, or by checking the application's version disclosure.
2. Identify target endpoint: Select any endpoint that enforces IP-based access controls, rate limiting, or audit logging — such as admin panels, API endpoints, or the DDoS captcha page (view/ddosCaptcha.php).
3. Craft forged HTTP request: Construct an HTTP request with a spoofed IP header. To impersonate localhost, use X-Client-IP: 127.0.0.1; to impersonate a trusted internal host, use X-Real-IP: 192.168.1.1.
4. Send the request: Execute the request using a tool such as curl:

   curl -H "X-Client-IP: 127.0.0.1" https://target.com/any_endpoint.php

5. Achieve objective: The server's getRealIpAddr() function returns the forged IP, causing IP-based access controls to be bypassed, rate limits to be circumvented, or audit logs to record the spoofed address instead of the attacker's real IP (GHSA Advisory).

• Network: HTTP requests to AVideo endpoints containing unusual or unexpected headers such as X-Client-IP, X-Real-IP, or X-Forwarded-For with loopback (127.0.0.1) or private IP addresses (e.g., 192.168.x.x, 10.x.x.x) from external sources.
• Logs: Web server access logs showing requests from IP addresses that do not match the actual network-layer source IP (i.e., discrepancy between TCP connection IP and logged IP); repeated access to restricted endpoints from apparent localhost or internal IPs.
• Application Logs: Audit log entries recording 127.0.0.1 or private IP ranges for actions performed by external users, indicating IP spoofing of audit records.
• Behavioral: Unusual access patterns to admin or restricted endpoints that would normally be blocked by IP allowlists, or sudden absence of rate-limiting enforcement for specific IP ranges (GHSA Advisory).

Apply the patch introduced in commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c, which refactors getRealIpAddr() to first validate REMOTE_ADDR as the authoritative source and only consult forwarding headers (HTTP_X_REAL_IP, HTTP_X_FORWARDED_FOR) when the direct connection originates from a private or loopback IP (i.e., a trusted reverse proxy). As a workaround prior to patching, configure a trusted reverse proxy or load balancer that strips and re-sets forwarding headers, and avoid relying solely on HTTP headers for IP-based access control decisions. Administrators should update to any AVideo version released after 26.0 that includes this fix (GHSA Advisory, Patch Commit).

The vulnerability was reported by security researcher ZeroXJacks and published by the AVideo maintainer DanielnetoDotCom on March 23, 2026. No significant broader media coverage or notable community commentary beyond the advisory itself has been identified at this time (GHSA Advisory).