5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33041

CVE-2026-33041: AVideo has an Unauthenticated Password Hash Oracle via encryptPass.json.php

WWBN AVideo is an open source video platform. In versions 25.0 and below, /objects/encryptPass.json.php exposes the application's password hashing algorithm to any unauthenticated user. An attacker can submit arbitrary passwords and receive their hashed equivalents, enabling offline password cracking against leaked database hashes. If an attacker obtains password hashes from the database (via SQL injection, backup exposure, etc.), they can instantly crack them by comparing against pre-computed hashes from this endpoint. This endpoint eliminates the need for an attacker to reverse-engineer the hashing algorithm. Combined with the weak hash chain (md5+whirlpool+sha1, no salt by default), an attacker with access to database hashes can crack passwords extremely quickly. This issue was fixed in version 26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33041

CVE-2026-33041:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists because the objects/encryptPass.json.php script provides a password hashing oracle to unauthenticated users. The script accepts a password via a GET/POST parameter (pass), calls the encryptPassword function to compute the application-specific hash, and then returns the hash in the response. This allows an attacker to build a rainbow table for the exact hashing algorithm used by the application (md5(hash('whirlpool', sha1($password))) by default, without salt). If an attacker later gains access to the user database (e.g., via SQL injection), they can use this pre-computed table to instantly crack the stored password hashes. The patch mitigates this by introducing strict authentication and rate-limiting to the encryptPass.json.php script, ensuring that only authorized users (admins) or trusted internal services can access the password hashing functionality.

Vulnerable functions

encryptPass.json.php

objects/encryptPass.json.php

This script is the main entry point for the vulnerability. It directly processes unauthenticated user requests, takes a password parameter, calls the `encryptPassword` function to hash it, and returns the hash. This behavior creates a password hash oracle, allowing an attacker to generate hashes for arbitrary passwords.

encryptPassword

objects/functions.php

This function is called by `encryptPass.json.php` to perform the password hashing. While the function itself was not patched, its exposure through an unauthenticated endpoint is the core of the vulnerability. The patch restricts access to the script that calls this function. An attacker leveraging the vulnerability would cause this function to be executed.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.