{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"25.0"}],"component":"wwbn/avideo","cve_ids":["CVE-2026-33292"],"ecosystem":"Packagist","epss":0.007,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-pw4v-x838-w5pg","id":"tcs_01M5KF6Q90J7Z5KAK6QM0G8FD9","modified_at":"2026-03-25T19:47:32.887413Z","published_at":"2026-03-19T16:43:03Z","references":["https://osv.dev/vulnerability/GHSA-pw4v-x838-w5pg","https://github.com/WWBN/AVideo/security/advisories/GHSA-pw4v-x838-w5pg","https://nvd.nist.gov/vuln/detail/CVE-2026-33292","https://github.com/WWBN/AVideo/commit/bc034066281085af00e64b0d7b81d8a025a928c4","https://github.com/WWBN/AVideo"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-pw4v-x838-w5pg","url":"https://osv.dev/vulnerability/GHSA-pw4v-x838-w5pg"}],"summary":"AVideo has an Authorization Bypass via Path Traversal in HLS Endpoint Allows Streaming Private/Paid Videos"}