Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
5.3
CVE-2026-33684: AVideo API Allows Anyone to Gain Elevated Permissions
CVE-2026-33684 · published 3 months ago
Summary
AVideo's API allows anyone to create an account with elevated permissions, such as the ability to upload, stream, and create meetings, by exploiting a weakness in its sign-up process. This can lead to unauthorized access to sensitive features. To fix this, AVideo should verify the authenticity of API requests and ensure that only authorized users can grant themselves elevated permissions.
What to do
- Update wwbn avideo to version 29.0.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| composer | wwbn | avideo |
< 29.0 Fix: upgrade to 29.0
|
| – | wwbn | avideo | < 29.0 |
Original advisory text
AVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions
WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, which allows any user who can solve a CAPTCHA to self-grant elevated permissions during account registration. The set_api_signUp method in the API plugin accepts emailVerified, canUpload, canStream, and canCreateMeet parameters from user-supplied input and applies them to newly created accounts without verifying that the request was authenticated with a valid APISecret. By self-granting account attributes, attackers can mark their own accounts as email-verified without owning the address (bypassing email-gated functionality) and award themselves upload, streaming, and meeting-creation permissions, circumventing administrator access controls that intentionally restrict these capabilities for new users. This issue has been fixed in version 29.0
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-8j8m-p79x-g4jm Vendor Advisory
- https://github.com/WWBN/AVideo/commit/061f242cba0e068cc1b461705fe839274b5038ff
- https://github.com/advisories/GHSA-8j8m-p79x-g4jm
- https://nvd.nist.gov/vuln/detail/CVE-2026-33684 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33684... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-862Missing Authorization
Timeline
Published15 Jul 2026
Updated4 Nov 2026
First seen22 Jun 2026
Track software like this
Free during beta