CVE-2026-34395 WWBN CVE debrief

Who should care

AVideo users and administrators should assess and apply patches if available. Security teams should verify AVideo usage in their environments and monitor for potential exploitation. Additionally, users with administrative privileges should be cautious when granting access to the vulnerable endpoint.

Technical summary

The plugin/YPTWallet/view/users.json.php endpoint in AVideo versions 26.0 and prior does not properly validate user permissions, allowing any authenticated user to access all platform users' personal information and wallet balances. The endpoint checks User::isLogged() but does not verify User::isAdmin(). This vulnerability can be exploited by any registered user, potentially leading to data breaches and unauthorized access to sensitive information.

Defensive priority

Medium priority due to the potential for data exposure and exploitation by authenticated users. Organizations should prioritize patching or mitigating this vulnerability to prevent unauthorized access to sensitive user information.

Recommended defensive actions

• Assess AVideo usage in your environment
• Verify if patches are available and apply them
• Monitor for potential exploitation attempts
• Restrict access to the vulnerable endpoint if patches are not available
• Implement additional authentication and authorization checks

Evidence notes

The CVE record was published on 2026-03-31T21:16:30.817Z and last modified on 2026-07-24T20:10:00.147Z. The NVD entry is currently Analyzed. The vulnerability was reported by a security researcher and is related to AVideo versions 26.0 and prior. The plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user.

Official resources