PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-34732 WWBN CVE debrief

CVE-2026-34732 is a vulnerability in WWBN AVideo that exposes sensitive data via unauthenticated data listing endpoints. The AVideo CreatePlugin template for list.json.php does not include authentication or authorization checks, unlike companion templates add.json.php and delete.json.php. This omission affects 21 plugins, exposing user PII, payment transaction logs, IP addresses, user agents, and internal system records. There are no publicly available patches at the time of publication.

Vendor
WWBN
Product
AVideo
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-03-31
Original CVE updated
2026-07-24
Advisory published
2026-03-31
Advisory updated
2026-07-24

Who should care

Administrators and users of WWBN AVideo, especially those using version 26.0 or prior, should be aware of this vulnerability. The exposure of sensitive data, including user PII and internal system records, makes this a concern for organizations using the affected versions of AVideo.

Technical summary

The vulnerability in WWBN AVideo arises from the CreatePlugin template for list.json.php lacking authentication and authorization checks. This affects all plugins generated with this template, resulting in 21 unauthenticated data listing endpoints. These endpoints expose sensitive information such as user personally identifiable information (PII), payment transaction logs, IP addresses, user agents, and internal system records. The CVSS score for this vulnerability is 5.3, classified as MEDIUM severity.

Defensive priority

Given the MEDIUM severity and the potential for data exposure, defensive measures should be prioritized to mitigate the risk of unauthorized data access.

Recommended defensive actions

  • Inventory and assess the use of WWBN AVideo within your organization, focusing on version 26.0 or prior.
  • Implement compensating controls to restrict access to the affected data listing endpoints.
  • Monitor for any suspicious activity related to these endpoints.
  • Consider applying patches or updates if available, or use alternative authentication mechanisms for plugins.
  • Review and update security configurations for AVideo plugins to ensure proper authentication and authorization checks are in place.

Evidence notes

The CVE record and NVD details confirm the vulnerability in WWBN AVideo, specifically in version 26.0 and prior. The lack of authentication in the list.json.php template of the CreatePlugin code generator leads to 21 unauthenticated data listing endpoints. Sensitive data exposure includes user PII, payment logs, IP addresses, user agents, and internal records. There are no known patches at publication time.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-34732 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-34732

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-34732 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-34732

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.