CVE-2026-34732 WWBN CVE debrief

Who should care

Administrators and users of WWBN AVideo, especially those using version 26.0 or prior, should be aware of this vulnerability. The exposure of sensitive data, including user PII and internal system records, makes this a concern for organizations using the affected versions of AVideo.

Technical summary

The vulnerability in WWBN AVideo arises from the CreatePlugin template for list.json.php lacking authentication and authorization checks. This affects all plugins generated with this template, resulting in 21 unauthenticated data listing endpoints. These endpoints expose sensitive information such as user personally identifiable information (PII), payment transaction logs, IP addresses, user agents, and internal system records. The CVSS score for this vulnerability is 5.3, classified as MEDIUM severity.

Defensive priority

Given the MEDIUM severity and the potential for data exposure, defensive measures should be prioritized to mitigate the risk of unauthorized data access.

Recommended defensive actions

• Inventory and assess the use of WWBN AVideo within your organization, focusing on version 26.0 or prior.
• Implement compensating controls to restrict access to the affected data listing endpoints.
• Monitor for any suspicious activity related to these endpoints.
• Consider applying patches or updates if available, or use alternative authentication mechanisms for plugins.
• Review and update security configurations for AVideo plugins to ensure proper authentication and authorization checks are in place.

Evidence notes

The CVE record and NVD details confirm the vulnerability in WWBN AVideo, specifically in version 26.0 and prior. The lack of authentication in the list.json.php template of the CreatePlugin code generator leads to 21 unauthenticated data listing endpoints. Sensitive data exposure includes user PII, payment logs, IP addresses, user agents, and internal records. There are no known patches at publication time.

Official resources