CVE-2026-33297: Password Reset Bypass in wwbn/avideo

The impact of CVE-2026-33297 is significant. An attacker can leverage this vulnerability to bypass channel-level access controls within wwbn/avideo. By exploiting this flaw, an attacker can effectively impersonate any user and gain unauthorized access to restricted content or functionality. This could lead to data breaches, unauthorized modifications, or disruption of services. The ease of exploitation – simply submitting a non-numeric password – makes this a high-risk vulnerability, particularly for systems with sensitive channel-protected content. The lack of proper input validation and sanitization is the root cause, allowing malicious input to bypass intended security measures.

1. Reserved2026-03-18
2. Published2026-03-19
3. Modified2026-04-07
4. EPSS updated2026-03-31

The primary mitigation for CVE-2026-33297 is to upgrade to wwbn/avideo version 26.0 or later, which contains the necessary fix. If upgrading immediately is not feasible, consider implementing temporary workarounds. While a direct WAF rule is difficult to implement due to the underlying logic flaw, strict input validation on the setPassword.json.php endpoint can help. Specifically, reject any password submissions containing non-numeric characters. Monitor access logs for unusual password reset attempts. After upgrading, confirm the fix by attempting to set a password containing non-numeric characters; the operation should fail with an appropriate error message, and the password should not be set to '0'.

Last updated

29.0recently