Is CVE-2026-33763 actively exploited?

No active exploitation of CVE-2026-33763 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-33763 be exploited remotely?

Yes. CVE-2026-33763 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-33763?

CVE-2026-33763 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-33763

MEDIUM

CVE-2026-33763

CWE-307Published: March 27, 2026· Updated: Mar 31, 2026

5.3

CVSS v3.1

EPSS:0.04%probability of exploitation in 30 daysPercentile:13.3th

Official Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `get_api_video_password_is_correct` API endpoint allows any unauthenticated user to verify whether a given password is correct for any password-protected video. The endpoint returns a boolean `passwordIsCorrect` field with no rate limiting, CAPTCHA, or authentication requirement, enabling efficient offline-speed brute-force attacks against video passwords. Commit 01a0614fedcdaee47832c0d913a0fb86d8c28135 contains a patch.

NVD Source

Technical Analysis

CVE-2026-33763 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.