Avideo CVE-2026-33688

The CVSS 3.1 score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) reflects a medium-severity information disclosure with low attack complexity and no privileges required, making this easily exploitable at network scale. The attack vector is network-accessible and requires no user interaction. While the CVSS rating is moderate, the practical risk is significant in context: username enumeration is a foundational reconnaissance technique that enables downstream targeted attacks (credential stuffing, password spraying, phishing). The vulnerability is automatable and scalable—an attacker can enumerate hundreds or thousands of valid usernames and map account statuses without triggering traditional rate-limiting protections. The absence of confidentiality impact on user data itself (only metadata leakage) and complete preservation of availability and integrity keep the CVSS at 5.3, but organizations running public AVideo instances should prioritize patching due to the reconnaissance value and potential downstream risks. KEV status is not indicated as actively exploited; however, the simplicity of the attack and availability of a public patch (with disclosed commit hash) creates moderate exploitation probability.

An attacker performs a script-based reconnaissance attack by submitting POST requests to the password recovery endpoint with a wordlist of common usernames. By analyzing the three distinct JSON error responses returned before captcha validation—distinguishing between non-existent users, inactive accounts, and banned accounts—the attacker rapidly maps a target AVideo instance's user population, identifies active user accounts, and detects banned users. This enumerated data is then used to inform a subsequent phishing campaign targeting active users or to focus credential-stuffing attacks on validated usernames, significantly increasing attack efficiency. The entire enumeration process bypasses captcha protections and requires no authentication, making it trivial to automate at scale.