What is the CVSS score of CVE-2026-34245?

CVE-2026-34245 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34245?

Organizations using versions should be aware of moderate risk from CVE-2026-34245, a missing authorization vulnerability rated CVSS 6.3. Attackers could gain access beyond their authorized level.

How to fix or mitigate CVE-2026-34245?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-34245

EUVD-2026-16715 MEDIUM

Missing Authorization (CWE-862)

2026-03-27 GitHub_M

GHSA-2rm7-j397-3fqg

PHP Authentication Bypass

6.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 17:15 euvd

EUVD-2026-16715

Analysis Generated

Mar 27, 2026 - 17:15 vuln.today

CVE Published

Mar 27, 2026 - 16:32 nvd

MEDIUM 6.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner's identity, allowing content hijacking and stream disruption. Commit 1e6dc20172de986f60641eb4fdb4090f079ffdce contains a patch.

AnalysisAI

Broadcast schedule modification in WWBN AVideo versions up to 26.0 allows authenticated users with streaming permissions to hijack playlists and disrupt streams by creating or modifying schedules targeting any playlist regardless of ownership, with rebroadcasts executing under the victim's identity. The vulnerability affects the plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint and stems from insufficient authorization checks. Upstream fix available via commit 1e6dc20172de986f60641eb4fdb4090f079ffdce; no public exploit identified at time of analysis.

Technical ContextAI

WWBN AVideo is an open-source video platform built on PHP that implements playlist and broadcast scheduling functionality. The vulnerability exists in the authorization layer of the add.json.php endpoint, specifically in the plugin directory handling broadcast schedule creation. The underlying issue is classified as CWE-862 (Missing Authorization), which indicates the application performs authentication (confirming the user's identity via streaming permission) but fails to enforce proper authorization checks (verifying the user has rights to modify a specific playlist). The vulnerability affects CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* across all versions up to and including 26.0. The authorization bypass allows privilege escalation by enabling low-privileged streaming users to execute actions reserved for playlist owners.

RemediationAI

Upgrade WWBN AVideo to a patched version released after commit 1e6dc20172de986f60641eb4fdb4090f079ffdce (check the official GitHub repository for the next tagged release incorporating this commit). Until patching is possible, restrict streaming permissions to trusted users only and implement network-level access controls limiting playlist modification endpoints to authenticated administrative accounts. Audit broadcast schedule creation logs for any schedules targeting playlists not owned by the creating user, and disable any suspicious schedules immediately. Review the patch commit at https://github.com/WWBN/AVideo/commit/1e6dc20172de986f60641eb4fdb4090f079ffdce to understand the authorization checks being added and ensure they are deployed.