What is the CVSS score of CVE-2026-33719?

CVE-2026-33719 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-33719?

WWBN AVideo installations are vulnerable to unauthorized modification of CDN configuration and storage credentials by unauthenticated attackers, potentially enabling data theft, service disruption,…

How to fix or mitigate CVE-2026-33719?

Within 24 hours: Audit all AVideo instances to identify which are running version 26.0 or earlier with CDN plugin enabled, and document CDN storage credentials and access keys in use. Within 7 days: Implement network segmentation to restrict CDN plugin access to trusted administrative networks only, disable the CDN plugin if not actively required, and rotate all storage credentials and authentication keys. Within 30 days: Evaluate migration to alternative video platforms, establish continuous monitoring for unauthorized CDN configuration changes, and maintain an incident response plan for potential credential compromise.

PHP CVE-2026-33719

EUVD-2026-14506 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-23 GitHub_M

GHSA-r64r-883r-wcwh

PHP Authentication Bypass

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 23, 2026 - 19:00 euvd

EUVD-2026-14506

Analysis Generated

Mar 23, 2026 - 19:00 vuln.today

CVE Published

Mar 23, 2026 - 18:49 nvd

HIGH 8.6

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration - including CDN URLs, storage credentials, and the authentication key itself - via mass-assignment through the par request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch.

AnalysisAI

WWBN AVideo video platform up to and including version 26.0 contains an authentication bypass vulnerability in the CDN plugin that allows unauthenticated remote attackers to completely modify CDN configuration settings including storage credentials and authentication keys. The vulnerability stems from the CDN plugin's default empty string authentication key, which causes validation checks to be bypassed entirely when the plugin is enabled but not properly configured. The CVSS score of 8.6 reflects high integrity impact with network-based exploitation requiring no privileges or user interaction.

Technical ContextAI

This vulnerability affects WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), an open-source PHP-based video streaming platform. The root cause is CWE-306 (Missing Authentication for Critical Function), where the CDN plugin endpoints plugin/CDN/status.json.php and plugin/CDN/disable.json.php implement key-based authentication but default to an empty string as the authentication key. When administrators enable the CDN plugin without explicitly configuring a custom key, the validation logic is completely bypassed because the empty default key matches the uninitialized state. The vulnerability is compounded by mass-assignment through the 'par' request parameter, allowing attackers to modify arbitrary CDN configuration properties including URLs, storage credentials, and even the authentication key itself.

RemediationAI

Apply the patch available in commit adeff0a31ba04a56f411eef256139fd7ed7d4310 by upgrading to a version newer than 26.0 that includes this fix (see https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310 and https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh). If immediate patching is not possible, disable the CDN plugin entirely if not in active use, or immediately configure a strong authentication key for the CDN plugin to prevent the bypass condition. Review CDN configuration settings for unauthorized modifications including URLs, storage credentials, and authentication keys, and implement network-level access controls to restrict access to CDN plugin endpoints to trusted IP ranges only.