What is the CVSS score of CVE-2026-33037?

CVE-2026-33037 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Docker are affected by CVE-2026-33037?

WWBN AVideo versions 25.0 and below contain hardcoded default administrator credentials ('password') in Docker deployments that grant immediate full administrative access without forced change during…. A patch is available.

How to fix or mitigate CVE-2026-33037?

Within 24 hours: Inventory all WWBN AVideo instances and identify version numbers; disable public network access if immediate upgrade is not feasible. Within 7 days: Upgrade to WWBN AVideo 25.1 or later (vendor-released patch); force password change on all administrative accounts and verify database credentials have been modified from default (avideo/avideo). Within 30 days: Conduct audit of administrative access logs and user activities since deployment; implement network segmentation limiting AVideo administrative interfaces to authorized personnel only.

Docker CVE-2026-33037

EUVD-2026-13575 HIGH

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-03-20 security-advisories@github.com

RCE Information Disclosure Docker

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:19 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

26.0

EUVD ID Assigned

Mar 20, 2026 - 08:37 euvd

EUVD-2026-13575

Analysis Generated

Mar 20, 2026 - 08:37 vuln.today

CVE Published

Mar 20, 2026 - 06:16 nvd

HIGH 8.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0.

AnalysisAI

WWBN AVideo open source video platform versions 25.0 and below ship with a hardcoded default administrator password ('password') in official Docker deployment files that is automatically used during installation without any forced change mechanism. Attackers can gain immediate administrative access to unpatched instances, enabling user data exposure, content manipulation, and potential remote code execution via file upload and plugin management features. The issue is compounded by weak MD5 password hashing and similarly insecure default database credentials (avideo/avideo).

Technical ContextAI

This vulnerability is classified under CWE-1188 (Insecure Default Initialization of Resource), specifically relating to hardcoded credentials in infrastructure-as-code deployment files. The WWBN AVideo platform uses Docker Compose for deployment orchestration, with environment configuration templates (docker-compose.yml and env.example) containing the SYSTEM_ADMIN_PASSWORD parameter preset to 'password'. During automated installation, this value seeds the administrative account without validation, complexity enforcement, or post-installation password change requirements. The authentication mechanism relies on MD5 hashing, a cryptographically broken algorithm vulnerable to collision attacks and rainbow table lookups, further degrading the security posture even if passwords were changed post-deployment.

RemediationAI

Upgrade WWBN AVideo to version 26.0 or later, which addresses the insecure default credential issue as documented in GitHub commit 2075fac1a51f21fab5d8592235a095aa354a9de6 and security advisory GHSA-89rv-p523-6wg9 (https://github.com/WWBN/AVideo/security/advisories/GHSA-89rv-p523-6wg9). For existing deployments that cannot be immediately upgraded, immediately change the administrator password through the application interface to a strong, unique credential and rotate database credentials from the default 'avideo/avideo' combination. Review all Docker environment files to ensure SYSTEM_ADMIN_PASSWORD is set to a secure value before any new deployments. Implement network segmentation to restrict administrative interface access to trusted IP ranges and consider placing the application behind a web application firewall with brute-force protection. Organizations should audit all existing AVideo instances deployed via Docker to verify that default credentials were changed post-installation.