Read the docs
TI-2021-04386 Aliases CVE-2021-21286

Authorization Bypass in AVideo Platform

Priority LOW 39CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-863.

Summary

AVideo Platform is an open-source Audio and Video platform. It is similar to a self-hosted YouTube. In AVideo Platform before version 10.2 there is an authorization bypass vulnerability which enables an ordinary user to get admin control. This is fixed in version 10.2. All queries now remove the pass hash and the recoverPass hash.

Why it matters now

EPSS 0.0078 56th percentileScored 2026-11-07
Fix Fixed AVideo (WWBN): 10.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WWBNAVideobefore 10.210.2Patch availableCNA
  • AVideo VendorWWBN Affected before 10.2 Fixed in 10.2 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*before 10.2VulnerableWWBN
  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* Versions before 10.2 Vulnerable ·WWBN

Remediation

  • Fix · CNA AVideo (WWBN) Fixed in 10.2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21286

References

Advisory 2

  • TI-2026-29567 Code injection in WWBN AVideo CVSS 3.1CRITICAL 10.0
  • TI-2026-26095 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVSS 3.1CRITICAL 9.4
  • TI-2026-25874 Improper access control in WWBN AVideo CVSS 3.1CRITICAL 10.0
  • TI-2026-25758 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVSS 3.1CRITICAL 9.8
  • TI-2024-20951 An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
  • TI-2023-10706 OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4… CVSS 3.1CRITICAL 9.8
See all 189 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences