Avideo CVE-2026-33690

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N) indicates network-based attack vector, low attack complexity, no privileges or user interaction required, and integrity impact only—a low-to-medium severity rating. The integrity impact reflects the ability to forge audit logs or deceive IP-based access control decisions rather than direct code execution or confidentiality breaches. While EPSS data is not provided in this analysis, the lack of reported public exploits, POC code, or KEV designation suggests real-world exploitation is not yet widespread. However, the attack is trivially automatable and requires no special tools beyond HTTP header manipulation, making it a realistic concern for organizations relying on IP-based rate limiting, geographic restrictions, or forensic logging. The practical risk depends heavily on the deployment context: environments using AVideo for sensitive content with strict IP-based controls face higher risk, while those without such protections face minimal immediate harm from this specific flaw.

An attacker crafts HTTP requests to an AVideo instance with spoofed X-Forwarded-For headers containing a different IP address than their actual source. If the application relies on IP-based access controls (e.g., allowing only certain geographic regions or corporate IP ranges), the attacker bypasses these by appearing to originate from an allowed range. Simultaneously, any security audit logs or rate-limiting systems that record or throttle by client IP address will be poisoned with false source addresses, obfuscating the attacker's identity and complicating forensic analysis. Since no authentication is required and the attack requires only HTTP header manipulation, an attacker can perform this repeatedly over a single connection without triggering suspicious patterns.