What is the CVSS score of CVE-2026-34362?

CVE-2026-34362 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34362?

Organizations using versions should be aware of moderate risk from CVE-2026-34362 rated CVSS 5.4. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-34362?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-34362

EUVD-2026-16719 MEDIUM

Insufficient Session Expiration (CWE-613)

2026-03-27 GitHub_M

GHSA-2mg4-pfgx-64cf

PHP Information Disclosure

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 17:15 euvd

EUVD-2026-16719

Analysis Generated

Mar 27, 2026 - 17:15 vuln.today

CVE Published

Mar 27, 2026 - 16:42 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the verifyTokenSocket() function in plugin/YPTSocket/functions.php has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legitimately obtained tokens to provide permanent WebSocket access, even after user accounts are deleted, banned, or demoted from admin. Admin tokens grant access to real-time connection data for all online users including IP addresses, browser info, and page locations. Commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 fixes the issue.

AnalysisAI

WebSocket token validation bypass in WWBN AVideo versions up to 26.0 allows authenticated attackers to retain permanent real-time access to sensitive connection metadata after account revocation. The verifyTokenSocket() function fails to enforce token expiration despite generating 12-hour timeouts, enabling captured tokens to grant indefinite access to admin-level data including IP addresses, browser fingerprints, and user page locations. Authenticated users (PR:L per CVSS vector) can exploit this to maintain surveillance capabilities even after account deletion or privilege demotion. No public exploit identified at time of analysis.

Technical ContextAI

WWBN AVideo is an open-source PHP-based video platform utilizing WebSocket functionality for real-time communication. The vulnerability exists in the plugin/YPTSocket/functions.php file where the verifyTokenSocket() function contains commented-out token timeout validation logic (CWE-613: Insufficient Session Expiration). WebSocket tokens are cryptographically generated with a declared 12-hour validity period, but the expiration check is disabled in the validation routine, causing the token authentication mechanism to treat all previously-issued tokens as indefinitely valid. This is a session management failure at the protocol level affecting authenticated WebSocket connections. The CPE specification (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) confirms impact across all AVideo deployments.

RemediationAI

Upgrade WWBN AVideo to the version incorporating commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 or later. Consult the vendor security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-2mg4-pfgx-64cf for confirmed release version details and timeline. Until patching is possible, immediately rotate all existing WebSocket authentication tokens and enforce token re-generation on every admin or elevated-privilege session initiation. Implement network-level access controls to restrict WebSocket connections to trusted administrative IP ranges and consider temporarily disabling real-time user connection telemetry in the YPTSocket plugin if operationally feasible. Additionally, audit audit logs for any admin-level WebSocket sessions from compromised or revoked accounts and assume any token issued prior to remediation as potentially compromised.