What is the CVSS score of CVE-2026-33649?

CVE-2026-33649 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33649?

A critical vulnerability in WWBN AVideo allows attackers to trick administrators into granting unauthorized elevated privileges through a malicious webpage, potentially compromising video platform…

How to fix or mitigate CVE-2026-33649?

Within 24 hours: Inventory all AVideo installations, identify version numbers, and restrict administrator browsing on affected systems. Within 7 days: Implement SameSite cookie enforcement at the WAF/reverse proxy level, disable the setPermission.json.php endpoint if not critical to operations, and apply compensating controls listed below. Within 30 days: Establish a monitoring plan for vendor patch releases, evaluate migration to alternative platforms if patches remain unavailable, and conduct security awareness training for administrative staff on phishing and social engineering risks.

PHP CVE-2026-33649

EUVD-2026-14486 HIGH

Cross-Site Request Forgery (CSRF) (CWE-352)

2026-03-23 GitHub_M

PHP CSRF

8.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 18:45 euvd

EUVD-2026-14486

Analysis Generated

Mar 23, 2026 - 18:45 vuln.today

CVE Published

Mar 23, 2026 - 18:26 nvd

HIGH 8.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/Permissions/setPermission.json.php endpoint accepts GET parameters for a state-changing operation that modifies user group permissions. The endpoint has no CSRF token validation, and the application explicitly sets session.cookie_samesite=None on session cookies. This allows an unauthenticated attacker to craft a page with <img> tags that, when visited by an admin, silently grant arbitrary permissions to the attacker's user group - escalating the attacker to near-admin access. As of time of publication, no known patched versions are available.

AnalysisAI

A Cross-Site Request Forgery (CSRF) vulnerability in WWBN AVideo open source video platform versions up to and including 26.0 allows unauthenticated attackers to escalate privileges to near-admin access by tricking an administrator into visiting a malicious page. The vulnerability exists in the setPermission.json.php endpoint which accepts state-changing operations via GET requests without CSRF token validation, compounded by the application's explicit SameSite=None cookie setting. No patched version is currently available, and with a CVSS score of 8.1 (High), this represents a significant risk for installations with administrative users who browse external content.

Technical ContextAI

The vulnerability affects WWBN AVideo (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), a PHP-based open source video streaming platform. The root cause is CWE-352 (Cross-Site Request Forgery), where the plugin/Permissions/setPermission.json.php endpoint performs privilege-modifying operations via HTTP GET requests without validating anti-CSRF tokens. This design flaw is exacerbated by the application's configuration of session.cookie_samesite=None, which explicitly allows cookies to be sent in cross-site contexts, defeating the browser's default CSRF protections. The combination enables attackers to embed simple HTML tags (such as img elements with crafted src attributes) that trigger unauthorized permission changes when loaded by an authenticated administrator.

RemediationAI

As of the time of publication, no patched version of WWBN AVideo is available to address this vulnerability, as confirmed in the advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-g8x9-7mgh-7cvj. Until an official patch is released, administrators should implement compensating controls including restricting administrative access to trusted networks only, educating admin users about not following untrusted links while authenticated, implementing web application firewall rules to block suspicious GET requests to the setPermission.json.php endpoint, and considering setting session.cookie_samesite to Strict or Lax if application functionality permits. Monitor the GitHub repository and security advisory for patch announcements and apply updates immediately when available. Organizations with high-risk exposure may need to evaluate temporarily disabling the Permissions plugin or implementing custom CSRF token validation at the reverse proxy or WAF level.