EUVD-2026-277874

fkie_cve-2026-33867

WWBN AVideo is an open source video platform. In versions up to and including 26.0, AVideo allows content owners to password-protect individual videos. The video password is stored in the database in plaintext — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext. Commit f2d68d2adbf73588ea61be2b781d93120a819e36 contains a patch.

GHSA-363v-5rh8-23wg — AVideo has Plaintext Video Password Storage

Affected: Packagist: wwbn/avideo

### Summary

AVideo allows content owners to password-protect individual videos. The video password is stored in the database in **plaintext** — no hashing, salting, or encryption is applied. If an attacker gains read access to the database (via SQL injection, a database backup, or misconfigured access controls), they obtain all video passwords in cleartext.

### Details

**File:** `objects/video.php`

**Vulnerable setter:** ```php public function setVideo_password($video_password) { AVideoPlugin::onVideoSetVideo_password($this->id, $this->video_password, $video_password); $this->video_password = trim($video_password); } ```

**Vulnerable getter:** ```php public function getVideo_password() { if (empty($this->video_password)) { return ''; } return trim($this->video_password); } ```

The value assigned to `$this->video_password` is only `trim()`-ed before being persisted to the database column `video_password` in the `videos` table. There is no call to any hashing function (e.g., `password_hash()`, `sha256`, or similar).

When a visitor enters a password to access a protected video, the comparison is done directly against the stored plaintext: ```php // Comparison at access check: if ($video->getVideo_password() === $_POST['password']) { ... } ```

This means: 1. Any database read (SQL injection, backup leak, hosting panel access) exposes all video passwords as cleartext. 2. Video passwords are often reused by users across other services, making th…

Most recent entries from all

EUVD-2026-277874

fkie_cve-2026-33867

GHSA-363v-5rh8-23wg — AVideo has Plaintext Video Password Storage