What is the CVSS score of CVE-2026-34374?

CVE-2026-34374 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Avideo are affected by CVE-2026-34374?

WWBN AVideo versions up to 26.0 contain a critical SQL injection vulnerability in the live streaming authentication mechanism that allows unauthenticated attackers to extract sensitive database…

How to fix or mitigate CVE-2026-34374?

Within 24 hours: Inventory all WWBN AVideo instances and document versions in use; immediately disable RTMP live streaming if not operationally critical. Within 7 days: Implement network-level access controls to restrict RTMP publish endpoints to trusted sources only; review database access logs for indicators of SQL injection attempts. Within 30 days: Plan upgrade path to version 27.0 or later once patches are released; monitor WWBN security advisories and CISA alerts for patch availability; evaluate alternative video platform solutions with active security maintenance if vendor patching timelines remain unclear.

Avideo CVE-2026-34374

EUVD-2026-16750 CRITICAL

SQL Injection (CWE-89)

2026-03-27 GitHub_M

SQLi Avideo

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 19:00 euvd

EUVD-2026-16750

Analysis Generated

Mar 27, 2026 - 19:00 vuln.today

CVE Published

Mar 27, 2026 - 18:16 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Live_schedule::keyExists() method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from LiveTransmition::keyExists() when the initial parameterized lookup returns no results. Although the calling function correctly uses parameterized queries for its own lookup, the fallback path to Live_schedule::keyExists() undoes this protection entirely. This vulnerability is distinct from GHSA-pvw4-p2jm-chjm, which covers SQL injection via the live_schedule_id parameter in the reminder function. This finding targets the stream key lookup path used during RTMP publish authentication. As of time of publication, no patched versions are available.

AnalysisAI

SQL injection in WWBN AVideo versions up to 26.0 allows unauthenticated remote attackers to extract sensitive database contents and modify data through the RTMP publish authentication stream key validation mechanism. The vulnerability (CVSS 9.1 Critical) arises from unsanitized string interpolation in Live_schedule::keyExists() fallback logic, affecting the open-source video platform's live streaming infrastructure. No vendor-released patch identified at time of analysis, and no public exploit identified at time of analysis.

Technical ContextAI

WWBN AVideo is an open-source video platform solution (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) that supports RTMP-based live streaming. The vulnerability stems from CWE-89 (SQL Injection) where the Live_schedule::keyExists() method constructs SQL queries using direct string interpolation of the stream key parameter. While LiveTransmition::keyExists() initially employs parameterized queries, the code falls back to the vulnerable Live_schedule method when no results are returned, bypassing the initial protection. This affects the RTMP publish authentication flow, where stream keys are validated before allowing broadcasters to transmit live video. The flaw is distinct from GHSA-pvw4-p2jm-chjm which targets the live_schedule_id parameter in reminder functionality.

RemediationAI

No vendor-released patch identified at time of analysis according to advisory documentation. Organizations should immediately implement compensating controls: deploy a web application firewall with SQL injection signature detection rules targeting the RTMP authentication endpoints, restrict RTMP port access (typically TCP 1935) to trusted IP ranges using network-layer access controls, implement database query monitoring to detect anomalous SQL patterns in Live_schedule table operations, and consider disabling live streaming functionality if not operationally required. Monitor the GitHub security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88 for upstream patch releases and code commits addressing this issue. Review application logs for suspicious stream key validation attempts showing SQL syntax patterns or timing-based enumeration indicators.