What is the CVSS score of CVE-2026-33716?

CVE-2026-33716 has a CVSS 3.1 base score of 9.4 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33716?

WWBN AVideo versions up to 26.0 contain a critical authentication bypass vulnerability that allows unauthenticated attackers to take complete control of live streams without user interaction,…

How to fix or mitigate CVE-2026-33716?

Within 24 hours: Inventory all systems running WWBN AVideo and isolate affected instances from public internet access; disable live streaming functionality if business-critical patches cannot be applied immediately. Within 7 days: Implement network segmentation to restrict access to AVideo streaming endpoints to authorized networks only; deploy WAF rules to block requests with suspicious 'streamerURL' parameters; monitor stream access logs for anomalous authentication patterns. Within 30 days: Contact WWBN for patch availability and deployment timeline; evaluate alternative live streaming solutions if patches remain unavailable; conduct forensic review of stream logs for evidence of compromise.

PHP CVE-2026-33716

EUVD-2026-14502 CRITICAL

Improper Authentication (CWE-287)

2026-03-23 GitHub_M

GHSA-9hv9-gvwm-95f2

PHP Authentication Bypass

9.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.4 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

High

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14502

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:46 nvd

CRITICAL 9.4

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the standalone live stream control endpoint at plugin/Live/standAloneFiles/control.json.php accepts a user-supplied streamerURL parameter that overrides where the server sends token verification requests. An attacker can redirect token verification to a server they control that always returns {"error": false}, completely bypassing authentication. This grants unauthenticated control over any live stream on the platform, including dropping active publishers, starting/stopping recordings, and probing stream existence. Commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 contains a patch.

AnalysisAI

WWBN AVideo versions up to and including 26.0 contain an authentication bypass vulnerability in the standalone live stream control endpoint. The endpoint accepts a user-supplied 'streamerURL' parameter that redirects token verification to an attacker-controlled server, allowing complete bypass of authentication without any user interaction. With a CVSS score of 9.4, an attacker gains unauthenticated control over any live stream including the ability to drop publishers, manipulate recordings, and probe stream existence.

Technical ContextAI

The vulnerability resides in plugin/Live/standAloneFiles/control.json.php of WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source video streaming platform built in PHP. The root cause is CWE-287 (Improper Authentication), where the application accepts external input to determine where authentication token verification requests should be sent. Rather than validating tokens against its own authentication infrastructure, the code allows the streamerURL parameter to redirect verification to arbitrary servers. An attacker can provide a malicious URL pointing to their own server that responds with a success message (such as {"error": false}), causing the application to incorrectly trust that authentication succeeded.

RemediationAI

Immediately upgrade to WWBN AVideo version 26.1 or later which includes the security fix implemented in commit 388fcd57dbd16f6cb3ebcdf1d08cf2b929941128 available at https://github.com/WWBN/AVideo/commit/388fcd57dbd16f6cb3ebcdf1d08cf2b929941128. If immediate patching is not possible, implement network-level access controls to restrict access to the plugin/Live/standAloneFiles/control.json.php endpoint to only trusted IP addresses or internal networks. Consider temporarily disabling the standalone live stream control functionality until patching can be completed. Review application logs for suspicious streamerURL parameters or unauthorized live stream control activity that may indicate exploitation attempts or successful compromise.