CVE-2026-33764
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the AI plugin's save.json.php endpoint loads AI response objects using an attacker-controlled $_REQUEST['id'] parameter without validating that the AI response belongs to the specified video. An authenticated user with AI permissions can reference any AI response ID — including those generated for other users' private videos — and apply the stolen AI-generated content (titles, descriptions, keywords, summaries, or full transcriptions) to their own video, effectively exfiltrating the information. Commit aa2c46a806960a0006105df47765913394eec142 contains a patch.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
wwbn/avideoPackagist | <= 26.0 | — |
Affected products
2Patches
Vulnerability mechanics
References
4- github.com/WWBN/AVideo/commit/aa2c46a806960a0006105df47765913394eec142nvdPatchWEB
- github.com/WWBN/AVideo/security/advisories/GHSA-g39v-qrj6-jxrhnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-g39v-qrj6-jxrhghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33764ghsaADVISORY
News mentions
0No linked articles in our index yet.