PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34395 WWBN CVE debrief

AVideo versions 26.0 and prior contain a vulnerability allowing any authenticated user to access all platform users' personal information and wallet balances. The vulnerability exists in the plugin/YPTWallet/view/users.json.php endpoint, which fails to properly validate user permissions. This issue can lead to unauthorized data exposure and potential exploitation by malicious actors.

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

AVideo users and administrators should assess and apply patches if available. Security teams should verify AVideo usage in their environments and monitor for potential exploitation. Additionally, users with administrative privileges should be cautious when granting access to the vulnerable endpoint.

Technical summary

The plugin/YPTWallet/view/users.json.php endpoint in AVideo versions 26.0 and prior does not properly validate user permissions, allowing any authenticated user to access all platform users' personal information and wallet balances. The endpoint checks User::isLogged() but does not verify User::isAdmin(). This vulnerability can be exploited by any registered user, potentially leading to data breaches and unauthorized access to sensitive information.

Defensive priority

Medium priority due to the potential for data exposure and exploitation by authenticated users. Organizations should prioritize patching or mitigating this vulnerability to prevent unauthorized access to sensitive user information.

Recommended defensive actions

  • Assess AVideo usage in your environment
  • Verify if patches are available and apply them
  • Monitor for potential exploitation attempts
  • Restrict access to the vulnerable endpoint if patches are not available
  • Implement additional authentication and authorization checks

Evidence notes

The CVE record was published on 2026-03-31T21:16:30.817Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability was reported by a security researcher and is related to AVideo versions 26.0 and prior. The plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34395 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34395

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34395 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34395

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.