What is the CVSS score of CVE-2026-34368?

CVE-2026-34368 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-34368?

Organizations using versions should be aware of moderate risk from CVE-2026-34368, a race condition vulnerability rated CVSS 5.3. Exploitation could compromise the security of affected deployments.

How to fix or mitigate CVE-2026-34368?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-34368

EUVD-2026-16734 MEDIUM

Race Condition (CWE-362)

2026-03-27 security-advisories@github.com

GHSA-h54m-c522-h6qr

PHP Race Condition Information Disclosure

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 18:22 euvd

EUVD-2026-16734

Analysis Generated

Mar 27, 2026 - 18:22 vuln.today

CVE Published

Mar 27, 2026 - 18:16 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the transferBalance() method in plugin/YPTWallet/YPTWallet.php contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance - all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix.

AnalysisAI

WWBN AVideo up to version 26.0 allows authenticated attackers to conduct concurrent balance transfers that exploit a Time-of-Check-Time-of-Use (TOCTOU) race condition in the wallet module, enabling arbitrary financial value multiplication without database transaction protection. An attacker with multiple authenticated sessions can trigger parallel transfer requests that each read the same wallet balance, all pass the sufficiency check independently, but result in only a single deduction while the recipient receives multiple credits. The vulnerability requires local authentication and moderate attacker effort (AC:H) but carries high integrity impact; no public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

The vulnerability resides in the transferBalance() method within WWBN AVideo's plugin/YPTWallet/YPTWallet.php file, which implements wallet balance transfer logic without atomic database transactions or row-level locking mechanisms. The root cause is classified as CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization), a canonical race condition pattern. The affected product is WWBN AVideo, an open-source video platform written in PHP that manages user wallet balances. When a transfer is initiated, the method reads the current sender balance from the database, validates sufficiency in PHP application logic, then updates both sender and recipient balances in separate write operations. Without explicit transaction boundaries (BEGIN/COMMIT/ROLLBACK) or database-level locks (SELECT FOR UPDATE), concurrent requests from the same user can interleave reads and writes, allowing multiple transfers to be validated against the same pre-transfer balance state while only the final write overwrites the intermediate deductions.

RemediationAI

Upgrade WWBN AVideo to a version incorporating commit 34132ad5159784bfc7ba0d7634bb5c79b769202d or later; consult the vendor security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr for the exact patched release version. The fix implements proper database transaction handling and row-level locking to prevent concurrent balance manipulation. Until patching is feasible, implement compensating controls by enforcing single-threaded wallet operations through application-level mutexes or database advisory locks for user accounts performing transfers, and monitor audit logs for suspicious patterns of multiple concurrent transfers from the same user within short time windows. Additionally, limit concurrent authenticated session count per user if the platform's architecture permits.