CVE-2026-33690

MEDIUM5.3

AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

Published Mar 23, 2026

Modified 1 months ago

Details

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the getRealIpAddr() function in objects/functions.php trusts user-controlled HTTP headers to determine the client's IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging. Commit 1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c contains a patch.

References

WEB

https://github.com/WWBN/AVideo/commit/1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c

WEB

https://github.com/WWBN/AVideo/security/advisories/GHSA-8p2x-5cpm-qrqw

ADVISORY

https://www.cve.org/CVERecord?id=CVE-2026-33690

CVSS Analysis

CVSS v3.1

5.3

Exploitability

Attack Vector