Avideo CVE-2026-34395

The CVSS 6.5 score reflects moderate severity with network accessibility and low attack complexity balanced against the requirement for prior authentication (PR:L). The vulnerability has High confidentiality impact and no integrity or availability impact, aligning with a data disclosure scenario. EPSS data is not provided, but the combination of low technical complexity, authenticated attack surface, and direct access to sensitive personal and financial data presents tangible real-world risk for multi-user AVideo deployments. The lack of a publicly available patch and the straightforward nature of the authorization bypass (missing admin check) increase likelihood of exploitation by insiders or compromised low-privilege accounts. SSVC framework would classify this as low-urgency for most organizations (no evidence of active exploitation and patch availability undetermined), but high-priority for deployments handling sensitive user data or those with elevated insider threat risk.

An attacker registers a low-privilege user account on a public WWBN AVideo instance and uses the valid session credentials to send an authenticated HTTP GET request to /plugin/YPTWallet/view/users.json.php. The endpoint returns a JSON array containing all registered users on the platform, including email addresses, usernames, personal information, and wallet account balances without additional authorization checks. The attacker harvests this data for targeted phishing, account enumeration for credential stuffing, or competitive intelligence. No public exploit code has been identified, but the vulnerability is trivial to reproduce given basic HTTP client tools and a registered account.