CVE-2026-33688 | WWBN AVideo up to 26.0 Password Recovery Endpoint userRecoverPass.php response discrepancy

VDB-352565 · CVE-2026-33688 · GCVE-0-2026-33688 WWBN AVIDEO UP TO 26.0 PASSWORD RECOVERY ENDPOINT USERRECOVERPASS.PHP RESPONSE DISCREPANCY HISTORYDIFFRELATEJSONXMLCTI CVSS Meta Temp Score Current Exploit Price (≈) CTI Interest Score 5.2 $0-$5k 1.92+ Summaryinfo A vulnerability has been found in WWBN AVideo up to 26.0 and classified as problematic. This issue affects some unknown processing of the file objects/userRecoverPass.php of the component Password Recovery Endpoint. The manipulation leads to response discrepancy. This vulnerability is referenced as CVE-2026-33688. Remote exploitation of the attack is possible. No exploit is available. Applying a patch is the recommended action to fix this issue. Detailsinfo A vulnerability was found in WWBN AVideo up to 26.0. It has been rated as problematic. This issue affects an unknown part of the file objects/userRecoverPass.php of the component Password Recovery Endpoint. The manipulation with an unknown input leads to a response discrepancy vulnerability. Using CWE to declare the problem leads to CWE-204. The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere. Impacted is confidentiality. The summary by CVE is: WWBN AVideo is an open source video platform. In versions up to and including 26.0, the password recovery endpoint at `objects/userRecoverPass.php` performs user existence and account status checks before validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses. Commit e42f54123b460fd1b2ee01f2ce3d4a386e88d157 contains a patch. The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-33688 since 03/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue. By approaching the search of inurl:objects/userRecoverPass.php it is possible to find vulnerable targets with Google Hacking. Applying the patch e42f54123b460fd1b2ee01f2ce3d4a386e88d157 is able to eliminate this problem. Productinfo Vendor WWBN Name AVideo Version 26.0 License open-source Website Product: https://github.com/WWBN/AVideo/ CPE 2.3info 🔒 CPE 2.2info 🔒 CVSSv4info VulDB Vector: 🔒 VulDB Reliability: 🔍 CVSSv3info VulDB Meta Base Score: 5.3 VulDB Meta Temp Score: 5.2 VulDB Base Score: 5.3 VulDB Temp Score: 5.1 VulDB Vector: 🔒 VulDB Reliability: 🔍 CNA Base Score: 5.3 CNA Vector (GitHub_M): 🔒 CVSSv2info Vector Complexity Authentication Confidentiality Integrity Availability Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock Unlock VulDB Base Score: 🔒 VulDB Temp Score: 🔒 VulDB Reliability: 🔍 Exploitinginfo Class: Response discrepancy CWE: CWE-204 / CWE-203 / CWE-200 CAPEC: 🔒 ATT&CK: 🔒 Physical: No Local: No Remote: Yes Availability: 🔒 Status: Not defined Google Hack: 🔒 Price Prediction: 🔍 Current Price Estimation: 🔒 0-Day Unlock Unlock Unlock Unlock Today Unlock Unlock Unlock Unlock Threat Intelligenceinfo Interest: 🔍 Active Actors: 🔍 Active APT Groups: 🔍 Countermeasuresinfo Recommended: Patch Status: 🔍 0-Day Time: 🔒 Patch: e42f54123b460fd1b2ee01f2ce3d4a386e88d157 Timelineinfo 03/23/2026 Advisory disclosed 03/23/2026 +0 days CVE reserved 03/23/2026 +0 days VulDB entry created 03/23/2026 +0 days VulDB entry last update Sourcesinfo Product: github.com Advisory: github.com Status: Confirmed CVE: CVE-2026-33688 (🔒) GCVE (CVE): GCVE-0-2026-33688 GCVE (VulDB): GCVE-100-352565 Entryinfo Created: 03/23/2026 20:10 Changes: 03/23/2026 20:10 (64) Complete: 🔍 Cache ID: 99:D67:101 Discussion No comments yet. Languages: en. Please log in to comment. ◂ PreviousOverviewNext ▸