Is CVE-2026-33037 actively exploited?

No active exploitation of CVE-2026-33037 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33037 be exploited remotely?

Yes. CVE-2026-33037 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33037?

CVE-2026-33037 has a CVSS score of 8.1 (HIGH).

HOME VULNERABILITIESCVE-2026-33037

HIGH

CVE-2026-33037

CWE-1188Published: March 20, 2026· Updated: Mar 23, 2026

8.1

CVSS v3.1

EPSS:0.23%probability of exploitation in 30 daysPercentile:45.6th

Official Description

WWBN AVideo is an open source video platform. In versions 25.0 and below, the official Docker deployment files (docker-compose.yml, env.example) ship with the admin password set to "password", which is automatically used to seed the admin account during installation, meaning any instance deployed without overriding SYSTEM_ADMIN_PASSWORD is immediately vulnerable to trivial administrative takeover. No compensating controls exist: there is no forced password change on first login, no complexity validation, no default-password detection, and the password is hashed with weak MD5. Full admin access enables user data exposure, content manipulation, and potential remote code execution via file uploads and plugin management. The same insecure-default pattern extends to database credentials (avideo/avideo), compounding the risk. Exploitation depends on operators failing to change the default, a condition likely met in quick-start, demo, and automated deployments. This issue has been fixed in version 26.0.

NVD Source

Technical Analysis

CVE-2026-33037 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

A successful exploit results in complete confidentiality breach (data exposure), full integrity compromise (data manipulation), availability disruption (denial of service), with a CVSS base score of 8.1.