CVE-2026-33296: AVideo has an Open Redirect via Unvalidated redirectUri in userLogin.php

March 19, 2026 (updated March 25, 2026)

WWBN/AVideo contains an open redirect vulnerability in the login flow where a user-supplied redirectUri parameter is reflected directly into a JavaScript document.location assignment without JavaScript-safe encoding. After a user completes the login popup flow, a timer callback executes the redirect using the unvalidated value, sending the victim to an attacker-controlled site.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/68d0fbb19e382fe62e6cc7bd48b51ffa1d9e310e
github.com/WWBN/AVideo/security/advisories/GHSA-hj5h-5623-gwhw
github.com/advisories/GHSA-hj5h-5623-gwhw
nvd.nist.gov/vuln/detail/CVE-2026-33296

Code Behaviors & Features

Detect and mitigate CVE-2026-33296 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →