What is the CVSS score of CVE-2026-33690?

CVE-2026-33690 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-33690?

Organizations using versions should be aware of moderate risk from CVE-2026-33690 rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-33690?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-33690

EUVD-2026-14500 MEDIUM

Use of Less Trusted Source (CWE-348)

2026-03-23 GitHub_M

GHSA-8p2x-5cpm-qrqw

PHP Authentication Bypass

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14500

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:45 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the getRealIpAddr() function in objects/functions.php trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging. Commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain an IP address spoofing vulnerability in the getRealIpAddr() function that trusts user-controlled HTTP headers to determine client IP addresses. This allows attackers to bypass IP-based access controls and audit logging mechanisms by forging headers such as X-Forwarded-For or X-Real-IP without authentication or user interaction. The vulnerability carries a CVSS score of 5.3 (medium severity) with low attack complexity, and a patch is available via commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c, though no public exploit code or KEV designation has been confirmed at this time.

Technical ContextAI

The vulnerability resides in the getRealIpAddr() function within objects/functions.php of the WWBN AVideo platform (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), a PHP-based open-source video streaming application. The root cause is classified under CWE-348 (Use of Less Trusted Source), where the application directly trusts HTTP headers like X-Forwarded-For, X-Real-IP, or similar client-provided values without validation or whitelisting. In typical deployments, AVideo may be behind a reverse proxy or load balancer, but the function fails to properly validate which headers are trustworthy or to implement proxy-aware IP detection. This is a common pitfall in PHP applications where developers assume all proxied requests include reliable header values, when in fact any network-adjacent attacker can inject or modify these headers in the HTTP request stream.

RemediationAI

Upgrade WWBN AVideo to a version released after commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c; consult the GitHub repository (https://github.com/WWBN/AVideo) for the next stable release incorporating this patch. As an interim workaround, if the application operates behind a trusted reverse proxy or load balancer, implement strict header validation by configuring the proxy to strip untrusted X-Forwarded-For and X-Real-IP headers and only trust the real source IP address seen by the proxy. Additionally, implement network-level access controls at the firewall or router to restrict AVideo's exposure to trusted networks, and consider disabling or reinforcing IP-based rate limiting and access controls until patching is complete. Code review of the getRealIpAddr() function or similar IP detection logic in custom deployments is advised.