Avideo CVE-2026-33685

The CVSS 3.1 score of 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects low-to-moderate severity: network-accessible, low attack complexity, no privileges required, and no user interaction—but only a confidentiality impact with no integrity or availability compromise. The lack of KEV (Known Exploited Vulnerability) status and absence of publicly disclosed proof-of-concept code suggest this is not yet actively exploited in the wild, though the ease of exploitation (unauthenticated network request) and non-disclosure-resistant nature of JSON endpoints mean weaponization is trivial. The vulnerability's real-world impact depends on the sensitivity of ad analytics in the specific deployment context; for platforms hosting competitive ad campaigns or sensitive audience data, information disclosure of user IDs, channel names, and engagement metrics poses reputational and competitive risk. The availability of a patch with a specific commit hash and GitHub security advisory indicates vendor responsiveness, lowering remediation friction. Overall assessment: moderate priority—fix promptly but not critical-tier urgency unless the deployment environment contains highly sensitive campaign data.

An attacker performs a simple HTTP GET request to the unprotected JSON endpoint (e.g., https://avideo-instance.com/plugin/AD_Server/reports.json.php) without authentication credentials and receives a complete JSON response containing ad campaign metadata, video titles, user identifiers, and engagement statistics. The attacker can then enumerate multiple campaigns by adjusting query parameters (if supported) or scrape the entire dataset programmatically to profile user behavior, competitor ad strategies, or identify valuable audience segments—all without triggering authentication logs or requiring user interaction. The attack is entirely automatable and requires only network connectivity to the AVideo instance.