Vulnerability · Published Dec 19, 2025 · Assigned by VulnCheck
CVE-2025-34433AVideo < 20.1 Unauthenticated RCE via Predictable Installation Salt
Critical 9.3
In plain English
A critical-severity code injection in AVideo from World Wide Broadcast Network. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.5% (higher than 74% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit.
Official description
AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| World Wide Broadcast Network | AVideo | 14.3.1 – before 20.1 |
Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
References
- https://github.com/WWBN/AVideo/commit/4a53ab2 patch
- https://github.com/WWBN/AVideo/commit/a2bdbff patch
- https://www.vulncheck.com/advisories/avideo-unauthenticated-rce-via-predictable-installation-salt third-party-advisory
- https://chocapikk.com/posts/2025/avideo-security-vulnerabilities/ technical-description, exploit