Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.
Scores
CVSS v3
7.5
EPSS
0.0001
EPSS Percentile
1.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
no
Technical Impact
total
Details
CWE
CWE-312
Status
published
Products (3)
wwbn/avideo
< 26.0
wwbn/avideo
0Packagist
WWBN/AVideo
<= 26.0
Published
Mar 27, 2026
Tracked Since
Mar 29, 2026