CVE-2026-33296

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

WWBN AVideo is an open source video platform. Prior to version 26.0, WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript `document.location` assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site. Version 26.0 fixes the issue.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

No affected versions have been published.

Timeline

Published: Mar 22, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-332979.1WWBN AVideo is an open source video platform. Prior to version 26.0, the `setPassword.json.php` endpoint in the CustomizeUser plugin allows CVE-2026-332987.8llama.cpp is an inference of several LLM models in C/C++. Prior to b7824, an integer overflow vulnerability in the `ggml_nbytes` function al CVE-2026-332995.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `N CVE-2026-33304.9The Form Maker by 10Web plugin for WordPress is vulnerable to SQL Injection via the 'ip_search', 'startdate', 'enddate', 'username_search', CVE-2026-333006.5Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.3, 2026.2.0-latest to before 2026.2.2, and 2 CVE-2026-333018.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, users with the `CVE-2026-333028.1OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, the module ACL fu CVE-2026-333035.4OpenEMR is a free and open source electronic health records and medical practice management application. Versions prior to 8.0.0.2 are vulne CVE-2026-333046.5OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333055.4OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization CVE-2026-333067.5bcrypt-ruby is a Ruby binding for the OpenBSD bcrypt() password hashing algorithm. Prior to version 3.1.22, an integer overflow in the Java CVE-2026-333077.5Mod_gnutls is a TLS module for Apache HTTPD based on GnuTLS. In versions prior to 0.12.3 and 0.13.0, code for client certificate verificatio