Executive Summary

CVE-2026-33512 is a high-severity vulnerability in the WWBN AVideo platform (versions up to and including 26.0) where the API plugin exposes a decryptString action without any authentication.

This means anyone can submit ciphertext to the decryptString API endpoint and receive the corresponding plaintext without needing to prove their identity or have any permissions.

Ciphertexts are publicly available through another endpoint, so any user can obtain encrypted tokens or metadata and then decrypt them using this unauthenticated API, exposing sensitive information.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability leads to a complete loss of confidentiality for any encrypted payload generated by the platform.

• Exposure of protected tokens and sensitive metadata such as video links, titles, and user IDs.
• Allows attackers to decrypt confidential data without authorization.
• Enables replay attacks and tampering where confidentiality was assumed.

There is no reported impact on data integrity or availability.

Useful 0 Not Useful 0

Compliance Impact

I don't know

Useful 0 Not Useful 0

Detection Guidance

[{'type': 'paragraph', 'content': "This vulnerability can be detected by checking if the WWBN AVideo platform's API endpoint for decrypting strings is accessible without authentication. Specifically, the endpoint `/plugin/API/get.json.php?APIName=decryptString` allows unauthenticated POST requests with a parameter `string` containing ciphertext to be decrypted."}, {'type': 'paragraph', 'content': 'A practical detection method involves attempting to decrypt a known ciphertext obtained from the publicly accessible endpoint `/view/url2Embed.json.php`.'}, {'type': 'list_item', 'content': 'Step 1: Obtain ciphertext by sending a GET request to `/view/url2Embed.json.php?url=<video_url>` and extract the `playLink` value.'}, {'type': 'list_item', 'content': 'Step 2: Send a POST request to `/plugin/API/get.json.php?APIName=decryptString` with content type `application/x-www-form-urlencoded` and parameter `string=<playLink ciphertext>`.'}, {'type': 'list_item', 'content': 'If the response returns decrypted plaintext without requiring authentication, the system is vulnerable.'}, {'type': 'paragraph', 'content': 'Example commands using curl:'}, {'type': 'list_item', 'content': 'curl -X GET "https://your-avideo-instance/view/url2Embed.json.php?url=https://example.com/video.mp4"'}, {'type': 'list_item', 'content': 'curl -X POST -d "string=<playLink_ciphertext>" "https://your-avideo-instance/plugin/API/get.json.php?APIName=decryptString" -H "Content-Type: application/x-www-form-urlencoded"'}] [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include:

• Apply the patch that enforces authentication on the decryptString API endpoint, requiring either valid admin access or a valid APISecret.
• Restrict access to the `/plugin/API/get.json.php?APIName=decryptString` endpoint to authorized users only.
• If patching is not immediately possible, consider disabling or removing the decryptString endpoint entirely.
• Rotate encryption keys and salts after applying the fix to invalidate any ciphertexts exposed prior to patching.
• Consider replacing reversible encryption with one-way cryptographic signatures (e.g., HMAC) for token protection to avoid similar issues.

Useful 0 Not Useful 0