{"id":"CVE-2026-33867","aliases":["GHSA-363v-5rh8-23wg"],"url":"https://o3.security/vulnerability/CVE-2026-33867","summary":"AVideo has Plaintext Video Password Storage","details":"### Summary\n\nAVideo allows content owners to password-protect individual videos. The video password is stored in the database in **plaintext** — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext.\n\n### Details\n\n**File:** `objects/video.php`\n\n**Vulnerable setter:**\n```php\npublic function setVideo_password($video_password)\n{\n    AVideoPlugin::onVideoSetVideo_password($this->id, $this->video_password, $video_password);\n    $this->video_password = trim($video_password);\n}\n```\n\n**Vulnerable getter:**\n```php\npublic function getVideo_password()\n{\n    if (empty($this->video_password)) {\n        return '';\n    }\n    return trim($this->video_password);\n}\n```\n\nThe value assigned to `$this->video_password` is only `trim()`-ed before being persisted to the database column `video_password` in the `videos` table. There is no call to any hashing function (e.g., `password_hash()`, `sha256`, or similar).\n\nWhen a visitor enters a password to access a protected video, the comparison is done directly against the stored plaintext:\n```php\n// Comparison at access check:\nif ($video->getVideo_password() === $_POST['password']) { ... }\n```\n\nThis means:\n1. Any database read (SQL injection, backup leak, hosting panel access) exposes all video passwords as cleartext.\n2. Video passwords are often reused by users across other services, making this a credential harvesting risk.\n3. The plaintext value is also present in application memory and any query logs.\n\n### PoC\n\n1. Set a password on any video via the AVideo admin/creator UI.\n2. Query the database: `SELECT clean_title, video_password FROM videos WHERE video_password != '';`\n3. All video passwords are returned in plaintext — no cracking required.\n\nAlternatively, exploit any of the SQL injection vulnerabilities already reported in this repository to extract the `video_password` column directly.\n\n### Impact\n\n- **Type:** Cleartext Storage of Sensitive Information (CWE-312)\n- **Severity:** High\n- **Authentication required:** No — any database read access (including via SQL injection by unauthenticated users) exposes all passwords\n- **Impact:** Full exposure of all video access passwords; credential reuse attacks against users who share passwords across services\n- **Fix:** Hash video passwords on write using `password_hash($video_password, PASSWORD_BCRYPT)` and verify on read using `password_verify($_POST['password'], $stored_hash)`","published":"2026-03-27T16:30:17.182Z","modified":"2026-08-12T03:51:42.739321706Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"wwbn/avideo","fixedVersion":null}],"fix":{"url":"https://github.com/WWBN/AVideo/commit/f2d68d2adbf73588ea61be2b781d93120a819e36","label":"WWBN/AVideo@f2d68d2"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33867.json"},{"type":"ADVISORY","url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-363v-5rh8-23wg"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33867"},{"type":"FIX","url":"https://github.com/WWBN/AVideo/commit/f2d68d2adbf73588ea61be2b781d93120a819e36"},{"type":"PACKAGE","url":"https://github.com/WWBN/AVideo"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.739321706Z"}}