How severe is CVE-2026-33763?

CVE-2026-33763 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-33763 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-33763?

CVE-2026-33763 affects Wwbn Avideo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-33763?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-33763 have an EU (EUVD) identifier?

Yes. CVE-2026-33763 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-16648.

When was CVE-2026-33763 published?

CVE-2026-33763 was published on 2026-03-27 and last updated on 2026-06-17.

CVE-2026-33763

CVE-2026-33763 is a medium-severity vulnerability in Wwbn Avideo with a CVSS 3.x base score of 5.3. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-307.

Key facts

Severity: Medium (CVSS 3.x base score 5.3)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-16648
Weakness: CWE-307
Affected product: Wwbn Avideo
Published: 2026-03-27
Last modified: 2026-06-17

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

Frequently asked questions

What is CVE-2026-33763?: WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.
How severe is CVE-2026-33763?: CVE-2026-33763 has a CVSS 3.x base score of 5.3, rated medium severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-33763 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-33763?: CVE-2026-33763 affects Wwbn Avideo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-33763?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-33763 have an EU (EUVD) identifier?: Yes. CVE-2026-33763 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-16648.
When was CVE-2026-33763 published?: CVE-2026-33763 was published on 2026-03-27 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

More vulnerabilities in Wwbn Avideo

CVE-2026-40911 — Critical (CVSS 10.0): WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server…
CVE-2026-33478 — Critical (CVSS 10.0): WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in…
CVE-2022-30547 — Critical (CVSS 9.9): A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master…
CVE-2026-41304 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the…
CVE-2026-33770 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method…
CVE-2026-33352 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability…

All CVEs affecting Wwbn Avideo →

Other CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerabilities

CVE-2026-6853 — Critical (CVSS 9.8): Improper restriction of excessive authentication attempts vulnerability in Başbelen Group Food Cafe Businesses…
CVE-2026-8760 — Critical (CVSS 9.8): The Login with OTP plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…
CVE-2020-37228 — Critical (CVSS 9.8): iDS6 DSSPro Digital Signage System 6.2 contains a CAPTCHA security bypass vulnerability that allows attackers to bypass…
CVE-2026-33879 — Critical (CVSS 9.8): Federated Learning and Interoperability Platform (FLIP) is an open-source platform for federated training and…
CVE-2026-33640 — Critical (CVSS 9.8): Outline is a service that allows for collaborative documentation. Outline implements an Email OTP login flow for users…
CVE-2026-31851 — Critical (CVSS 9.8): Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 does not implement rate limiting or account lockout…

Browse all CWE-307 (Improper Restriction of Excessive Authentication Attempts) vulnerabilities →