CVE-2026-33512 is a high-severity (CVSS 7.5) Improper Authentication vulnerability in wwbn/avideo. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.
AVideo has an unauthenticated decrypt oracle leaking any ciphertext
Exploitation Status
Proof-of-concept exploit code exists
- CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.
- CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
Exploitation and automatability from CISA’s SSVC triage for CVE-2026-33512.
EPSS Exploitation Probability
Probability of exploitation in the next 30 days, from FIRST.org EPSS.
How urgent is this, really
Where this sits among everything scored
Real-World Exposure
wwbn/avideoReal-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.
Description
Summary
The API plugin exposes a decryptString action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., view/url2Embed.json.php), so any user can recover protected tokens/metadata. Severity: High.
Details
- Entry:
plugin/API/get.json.phpis unauthenticated. - Handler:
plugin/API/API.phpget_api_decryptString()(lines ~5945–5966):
No APISecret or user check occurs before decrypting.$string = decryptString($_REQUEST['string']); return new ApiObject($string, empty($string)); - Public ciphertext source:
view/url2Embed.json.phpreturnsplayLink/playEmbedLink(encryptString(json_encode(...))) to any caller.
PoC
- Obtain ciphertext:
CopyGET /view/url2Embed.json.php?url=https://example.com/video.mp4playLink. - Decrypt without auth:
Response contains the plaintext JSON (videoLink, title, users_id, etc.).POST /plugin/API/get.json.php?APIName=decryptString Content-Type: application/x-www-form-urlencoded string=<playLink ciphertext>
Impact
- Any encrypted payload produced by the platform can be decrypted by anyone.
- Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.
Mitigation
- Require API secret or authenticated/authorized user for
decryptString, or remove the endpoint. - Prefer one-way signatures (HMAC) instead of exposing generic decryption.
- Rotate encryption keys/salts after patch to invalidate exposed ciphertexts.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐘Packagist | wwbn/avideo | all versions | No fix |
Affected Products
avideowwbnDetection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for wwbn/avideo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Remediation status
The records we use list no patched version of wwbn/avideo for CVE-2026-33512. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.
Mitigate without a patch
Put an independent control in front of the weakness: restrict the affected endpoint or interface to trusted networks, require an additional authentication factor or proxy-level check, and invalidate existing sessions and credentials in case the flaw has already been used.
Frequently Asked Questions
Is CVE-2026-33512 in your dependencies?
Find it across Packagist, including transitive dependencies.