Avideo CVE-2026-34362

The CVSS 3.1 score of 5.4 reflects moderate severity with network accessibility (AV:N), low attack complexity (AC:L), and requirement for low privileges (PR:L). The vector correctly identifies limited scope (S:U) and absence of integrity/availability impact, focusing on confidentiality loss (C:L, I:L, A:N). However, real-world risk is elevated beyond the CVSS numeric score due to several factors: (1) the vulnerability affects admin tokens specifically, which provide comprehensive surveillance access to all online user sessions; (2) token compromise is post-authentication but enables indefinite unauthorized access after legitimate session termination; (3) attack complexity is minimal once a token is obtained through social engineering, credential compromise, or insider access; (4) there is no temporal decay or forced re-authentication mechanism to limit exposure window. EPSS exploitation probability data is not provided, but the straightforward nature of token reuse (no cryptographic validation required) suggests high automatable exploitation potential. This should be prioritized above the baseline CVSS score suggests, particularly for multi-tenant deployments or those handling sensitive video content.

An authenticated user with legitimate AVideo access obtains an admin-level WebSocket token during normal platform interaction. The attacker captures this token through network traffic inspection, local session storage access, or memory dumping. After the user's admin account is revoked (e.g., due to employee termination), the attacker reuses the captured token to reconnect to the WebSocket service, bypassing all post-revocation authentication checks. The token validation fails to check expiration times, allowing the attacker to regain real-time visibility into all active user sessions, including IP addresses, browser information, and content being accessed-all without re-authentication or detection by standard session management controls.