CVE-2026-33867: 
PHP vulnerability analysis and mitigation

CVE-2026-33867 is a Cleartext Storage of Sensitive Information vulnerability (CWE-312) in WWBN AVideo, an open-source video platform. Video access passwords set by content owners are stored in the database in plaintext without any hashing, salting, or encryption, exposing them to any party with database read access. All versions up to and including 26.0 are affected; the issue is patched in version 29.0. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 9.1 (Critical). The vulnerability was published on March 24, 2026, and added to the GitHub Advisory Database on March 26, 2026 (GitHub Advisory).

The root cause lies in objects/video.php, where the setVideo_password() method only applies trim() to the password before persisting it to the video_password column of the videos table — no hashing function is invoked. The access check compares the stored plaintext directly against user-supplied input via $video->getVideo_password() === $_POST['password'], meaning the raw password is also present in application memory and any database query logs. An attacker who gains database read access — whether through SQL injection (including unauthenticated exploitation of separately reported SQLi flaws in AVideo), a leaked backup, or misconfigured access controls — can retrieve all video passwords without any cracking. The video_password column was also defined as VARCHAR(45), which would truncate bcrypt hashes, further preventing any future hashing migration without a schema change (GitHub Advisory, Patch Commit).

Successful exploitation results in full disclosure of all video access passwords stored in the AVideo database, with no cracking or brute-forcing required. Because users frequently reuse passwords across services, exposed video passwords can enable credential stuffing attacks against external platforms (email, social media, banking). The vulnerability has no impact on availability or system integrity directly, but the confidentiality impact is rated High, and the combination with existing SQL injection vulnerabilities in AVideo means unauthenticated attackers can chain exploits to harvest credentials without any prior access (GitHub Advisory).

A proof-of-concept is publicly documented in the GitHub Security Advisory, providing concrete, reproducible steps to demonstrate the vulnerability. The PoC includes both direct database query extraction and exploitation via existing SQL injection vulnerabilities in AVideo to retrieve the video_password column without authentication. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.015% (2nd percentile), indicating a low current probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog (GitHub Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances running version 26.0 or earlier using search engines (Shodan, Censys) or by checking the AVideo version endpoint.
2. Identify SQL injection entry point: Leverage any of the previously reported SQL injection vulnerabilities in the AVideo repository to gain unauthenticated database read access, or use a compromised database credential or backup file.
3. Extract plaintext passwords: Execute the following SQL query against the AVideo database to retrieve all video passwords in cleartext:

   SELECT clean_title, video_password FROM videos WHERE video_password != '';

4. Access protected videos: Use the retrieved plaintext passwords to directly access password-protected videos on the AVideo instance.
5. Credential reuse attacks: Test the harvested passwords against external services (email providers, social networks, etc.) where users may have reused the same password (GitHub Advisory).

• Database/Logs: Unexpected or unauthorized SELECT queries targeting the video_password column in the videos table, particularly from non-administrative database users or application accounts not normally issuing such queries.
• Application Logs: Unusual or high-volume SQL injection attempts in AVideo web access logs, especially targeting endpoints known to be vulnerable to SQLi in the AVideo codebase.
• Network: Outbound connections from the AVideo server to unknown external IPs following database query activity, which may indicate data exfiltration.
• File System: Presence of unexpected database dump files (.sql, .bak) in web-accessible directories or temporary folders, which could indicate an attacker staged a backup for exfiltration (GitHub Advisory).

Upgrade WWBN AVideo to version 29.0 or later, which implements bcrypt hashing via password_hash($video_password, PASSWORD_BCRYPT) on write and password_verify() on read, and expands the video_password column to VARCHAR(255) to accommodate hash storage. The patch also introduces a PASSWORD_KEEP sentinel to prevent accidental password overwrites during video edits, and modifies cleanUpRowFromDatabase() to strip the stored hash from API responses. If immediate patching is not possible, restrict database read access to only authorized application accounts, disable or firewall direct database access, and implement SQL injection protections (WAF rules, parameterized queries) to prevent unauthenticated database reads (GitHub Advisory, Patch Commit).

The vulnerability was reported by security researcher athuljayaram and published by the AVideo maintainer DanielnetoDotCom on March 24, 2026. The advisory was noted on Bluesky via the CVE SkyFleet bot and indexed by multiple vulnerability tracking platforms including VulDB, CIRCL, and CVEFeed shortly after publication. No significant broader media coverage or notable researcher commentary beyond the advisory itself has been identified (GitHub Advisory).