What is the CVSS score of CVE-2026-34395?

CVE-2026-34395 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

PHP CVE-2026-34395

EUVD-2026-17632 MEDIUM

Missing Authorization (CWE-862)

2026-03-31 GitHub_M

GHSA-77jp-mgcw-rfmr

Authentication Bypass PHP

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17632

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:38 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the plugin/YPTWallet/view/users.json.php endpoint returns all platform users with their personal information and wallet balances to any authenticated user. The endpoint checks User::isLogged() but does not check User::isAdmin(), so any registered user can dump the full user database. At time of publication, there are no publicly available patches.

AnalysisAI

Information disclosure in WWBN AVideo versions 26.0 and prior allows authenticated users to enumerate and dump the complete user database including personal information and wallet balances via the /plugin/YPTWallet/view/users.json.php endpoint. The vulnerability stems from inadequate authorization checks that verify user login status but fail to enforce administrator-only access, enabling any registered account holder to retrieve sensitive data belonging to all platform users. No public exploit code or active exploitation has been confirmed at time of analysis, and vendor patches are not yet available.

Technical ContextAI

WWBN AVideo is a PHP-based open source video streaming and management platform. The vulnerable endpoint users.json.php is part of the YPTWallet plugin and implements authentication via User::isLogged() to verify session validity, but lacks the corresponding authorization check (User::isAdmin()) required to restrict access to administrator-only resources. This represents an authorization bypass (CWE-862: Missing Authorization) where authentication and authorization are conflated. The endpoint exposes sensitive user profile data and financial information in JSON format without proper role-based access control. Any registered user with valid session credentials can craft HTTP requests to this endpoint and retrieve the serialized database of all users, their personal identifiers, and wallet balances.

RemediationAI

A vendor-released patch has not been independently confirmed at time of analysis. Organizations running WWBN AVideo should immediately review the GHSA-77jp-mgcw-rfmr security advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-77jp-mgcw-rfmr for patch availability and release timelines. As an interim mitigation, restrict network access to the /plugin/YPTWallet/view/users.json.php endpoint via web application firewall rules or reverse proxy configuration to permit only trusted IP addresses or administrative roles. Additionally, implement role-based access control enforcement at the application level by adding an explicit User::isAdmin() authorization check before returning user data in the vulnerable endpoint. Monitor access logs for suspicious requests to the YPTWallet plugin endpoints and review account access logs for evidence of unauthorized user enumeration.