What is the CVSS score of CVE-2026-33688?

CVE-2026-33688 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33688?

Organizations using versions should be aware of moderate risk from CVE-2026-33688 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-33688?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-33688

EUVD-2026-14498 MEDIUM

Observable Response Discrepancy (CWE-204)

2026-03-23 GitHub_M

GHSA-m99f-mmvg-3xmx

PHP Information Disclosure

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14498

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:43 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at objects/userRecoverPass.php performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned - at scale and without solving any captcha - by observing three distinct JSON error responses. Commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157 contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain an information disclosure vulnerability in the password recovery endpoint (objects/userRecoverPass.php) that allows unauthenticated attackers to enumerate valid usernames and determine account status (active, inactive, or banned) without solving any captcha. The vulnerability exists because user existence and account status validation occurs before captcha verification, enabling attackers to distinguish three different JSON error responses at scale. No evidence of active exploitation in the wild has been reported, but a patch is available in commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157.

Technical ContextAI

WWBN AVideo is an open-source PHP-based video platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) affected in all versions through 26.0. The vulnerability is rooted in CWE-204 (Observable Timing Discrepancy), though more accurately it represents a logic-flow flaw in password recovery functionality. The vulnerable code path in objects/userRecoverPass.php performs database queries to check username existence and retrieve account status information before executing captcha validation. This sequencing violates security best practices by allowing an attacker to infer user account details through differential error handling—the endpoint leaks timing and response differentiation that reveals whether a username exists and its associated account state, circumventing captcha rate-limiting that would normally protect against such enumeration attacks.

RemediationAI

Upgrade WWBN AVideo to a version newer than 26.0 that includes commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157 or later. Consult the vendor advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx for the exact patched version number and upgrade instructions. As an interim mitigation prior to patching, administrators should implement rate-limiting on the objects/userRecoverPass.php endpoint at the web server or reverse proxy level (using mod_ratelimit, fail2ban, or equivalent), configure CORS restrictions to prevent cross-origin enumeration, and consider temporarily disabling the password recovery feature if it is not actively needed. Monitor access logs for suspicious patterns of repeated failed password recovery attempts from single IP addresses.