What is the CVSS score of CVE-2026-34731?

CVE-2026-34731 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-34731?

CVE-2026-34731 allows unauthenticated attackers to remotely disable all live streaming on WWBN AVideo 26.0 and earlier through unsecured API endpoints, creating a complete denial-of-service risk for…. A patch is available.

How to fix or mitigate CVE-2026-34731?

Within 24 hours: Inventory all WWBN AVideo deployments and their version numbers; immediately disable or restrict network access to stats.json.php and on_publish_done.php endpoints using WAF rules or firewall ACLs. Within 7 days: Implement authentication enforcement at the web application layer for RTMP callback handlers; document all active live stream operations and establish manual failover procedures. Within 30 days: Contact WWBN for patch timeline; evaluate migration to alternative streaming platforms; implement IP whitelisting for RTMP publish callbacks to trusted encoder addresses only.

PHP CVE-2026-34731

EUVD-2026-17648 HIGH

Missing Authentication for Critical Function (CWE-306)

2026-03-31 GitHub_M

GHSA-4jcg-jxpf-5vq3

PHP Authentication Bypass

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17648

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:50 nvd

HIGH 7.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo on_publish_done.php endpoint in the Live plugin allows unauthenticated users to terminate any active live stream. The endpoint processes RTMP callback events to mark streams as finished in the database, but performs no authentication or authorization checks before doing so. An attacker can enumerate active stream keys from the unauthenticated stats.json.php endpoint, then send crafted POST requests to on_publish_done.php to terminate any live broadcast. This enables denial-of-service against all live streaming functionality on the platform. At time of publication, there are no publicly available patches.

AnalysisAI

Unauthenticated attackers can remotely terminate any active live stream in WWBN AVideo 26.0 and prior by sending crafted POST requests to the on_publish_done.php endpoint in the Live plugin. The vulnerability combines two weaknesses: an unauthenticated stats.json.php endpoint that exposes active stream keys, and the on_publish_done.php RTMP callback handler that processes stream termination requests without authentication or authorization checks. This enables complete denial-of-service against all platform live streaming functionality. CVSS 7.5 (High) with network attack vector, low complexity, and no privileges required. No vendor-released patch identified at time of analysis; EPSS data not available.

Technical ContextAI

This vulnerability affects the WWBN AVideo open source video platform's Live plugin, specifically RTMP (Real-Time Messaging Protocol) callback handling infrastructure. The on_publish_done.php endpoint is designed to receive callbacks from RTMP servers when broadcasts end, updating the database to mark streams as finished. The root cause is CWE-306 (Missing Authentication for Critical Function), where the callback handler trusts incoming requests without verifying their origin or authenticating the sender. The vulnerability is compounded by an information disclosure issue in stats.json.php, which exposes active stream keys to unauthenticated users, providing attackers with the enumeration capability needed to identify valid targets. The attack surface is exposed through standard HTTP POST requests to a PHP endpoint, requiring no specialized RTMP protocol knowledge to exploit once stream keys are enumerated.

RemediationAI

No vendor-released patch identified at time of analysis per the GitHub Security Advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-4jcg-jxpf-5vq3). Organizations should implement immediate compensating controls: add authentication and authorization checks to the on_publish_done.php endpoint to verify that callback requests originate from legitimate RTMP servers (validate source IP addresses against known streaming server IPs, implement shared secret token authentication). Restrict access to stats.json.php to authenticated users only to prevent stream key enumeration. Consider implementing rate limiting and request validation on both endpoints. Network-level controls should include firewall rules limiting access to the Live plugin endpoints to trusted networks only. Organizations should monitor the GitHub advisory and WWBN AVideo repository for official patches, and implement web application firewall rules to block unauthorized POST requests to on_publish_done.php in the interim. Given the critical nature of live streaming functionality, organizations may need to evaluate alternative video platforms if patches are not released promptly.