CVE-2026-33297 is a logic error in WWBN AVideo's CustomizeUser plugin. When an administrator sets a channel password containing non-numeric characters, the stored value silently becomes 0, which any visitor can guess. NVD scores it 9.1 critical and says version 26.0 fixes it.
What's affected
WWBN AVideo before version 26.0 per the NVD record. The GitHub advisory lists 25.0 and below as affected, but its patched versions field says none, and it rates the issue Moderate (5.1 on CVSS v4). Because the sources disagree, confirm the fix against the project's release notes before you rely on it.
Only channels where an administrator set a non-numeric channel password are weakened.
How to check if you're exposed
If you installed AVideo from Composer, list the installed version:
composer show wwbn/avideo
Otherwise read the version from your admin panel. Then list which channels use a channel password, since those are the ones to retest.
What to do now
- Upgrade to version 26.0 or later, and check the project's notes that the fix is included.
- For each channel that relies on a channel password, test it from a logged out browser. If entering 0 grants access, the protection is not working.
- Do not rely on channel passwords for sensitive content until you have confirmed the fix.
- Move truly private video behind account based access control.
Why it matters
The record maps this to CWE-639, authorization bypass through a user controlled key. The advisory itself describes a type coercion bug: the password is run through an integer conversion, so text becomes zero without any error.
The danger is that nothing looks wrong. The admin sees a successful save and believes the channel is protected. The record does not flag this CVE as listed in CISA's Known Exploited Vulnerabilities catalog.
Quick check
Why do the NVD and GitHub scores differ so much?
NVD scores the access control impact at 9.1 with no privileges needed to visit the channel. The advisory scores it 5.1 and notes that an administrator action is required to set the password. Both describe the same bug.
Sources
Last reviewed: 19 October 2026.
