Is CVE-2026-33759 actively exploited?

No active exploitation of CVE-2026-33759 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33759 be exploited remotely?

Yes. CVE-2026-33759 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33759?

CVE-2026-33759 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33759

MEDIUM

CVE-2026-33759

CWE-639Published: March 27, 2026· Updated: Mar 31, 2026

5.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:12.8th

Official Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `objects/playlistsVideos.json.php` endpoint returns the full video contents of any playlist by ID without any authentication or authorization check. Private playlists (including `watch_later` and `favorite` types) are correctly hidden from listing endpoints via `playlistsFromUser.json.php`, but their contents are directly accessible through this endpoint by providing the sequential integer `playlists_id` parameter. Commit bb716fbece656c9fe39784f11e4e822b5867f1ca has a patch for the issue.

NVD Source

Technical Analysis

CVE-2026-33759 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.