What’s Vulnerable › Vulnerabilities

CVE-2026-33759: AVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-27 · updated 2026-10-26
• Weakness: CWE-639

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.

Affected products

• WWBN AVideo: through 26.0

References

• https://github.com/WWBN/AVideo/commit/bb716fbece656c9fe39784f11e4e822b5867f1ca
• https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr
• https://github.com/WWBN/AVideo/security/advisories/GHSA-75qq-68m8-pvfr

Get alerted when CVE-2026-33759 or the next vulnerability affects your stack