CVE-2026-33690: AVideo vulnerable to IP Address Spoofing via Untrusted HTTP Headers in getRealIpAddr()

March 25, 2026

The getRealIpAddr() function in objects/functions.php trusts user-controlled HTTP headers to determine the client’s IP address. An attacker can spoof their IP address by sending forged headers, bypassing any IP-based access controls or audit logging.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/1a1df6a9377e5cc67d1d0ac8ef571f7abbffbc6c
github.com/WWBN/AVideo/security/advisories/GHSA-8p2x-5cpm-qrqw
github.com/advisories/GHSA-8p2x-5cpm-qrqw
nvd.nist.gov/vuln/detail/CVE-2026-33690

Code Behaviors & Features

Detect and mitigate CVE-2026-33690 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →