What is the CVSS score of CVE-2026-34737?

CVE-2026-34737 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34737?

Yes, a patch is available for CVE-2026-34737. Update the affected software to the latest version immediately.

PHP CVE-2026-34737

EUVD-2026-17654 MEDIUM

Missing Authorization (CWE-862)

2026-03-31 GitHub_M

GHSA-38rh-4v39-vfxv

PHP Authentication Bypass

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17654

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:53 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. At time of publication, there are no publicly available patches.

AnalysisAI

Authenticated users in WWBN AVideo 26.0 and prior can cancel arbitrary Stripe subscriptions through an exposed test.php debug endpoint in the StripeYPT plugin, exploiting a logic error in the retrieveSubscriptions() method that performs cancellation instead of retrieval. The vulnerability requires valid login credentials but allows any authenticated user-not just administrators-to trigger subscription cancellations, causing integrity violations to payment operations. No public exploit code or active exploitation has been reported at time of analysis, and vendor patches are not yet available.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video platform that integrates the StripeYPT plugin for subscription payment processing. The vulnerability stems from inadequate access controls on a debug endpoint (test.php) that processes Stripe webhook payloads. The underlying root cause (CWE-862: Missing Authorization) manifests as a combination of two security gaps: first, the test.php endpoint is accessible to any authenticated user rather than being restricted to administrators or disabled entirely in production; second, the retrieveSubscriptions() method contains a logic error where it invokes subscription cancellation APIs instead of read-only retrieval operations. Stripe's webhook processing typically validates authenticity via HMAC signatures, but the test endpoint appears to bypass this validation, allowing any authenticated session to craft malicious payloads. The CPE cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* indicates all versions up to and including 26.0 are affected.

RemediationAI

No vendor-released patch is available at time of analysis. Organizations running WWBN AVideo 26.0 or prior with the StripeYPT plugin should immediately implement the following mitigations: (1) Disable or restrict network access to the test.php debug endpoint by removing the file from production deployments or implementing strict firewall/web application firewall rules to block requests to paths containing test.php; (2) Limit user account creation and access to trusted administrators only, reducing the pool of potential attackers with authentication credentials; (3) Monitor Stripe subscription activity for unexpected cancellations and establish alerts on webhook processing logs; (4) Review recent audit logs for any unauthorized subscription modifications. Monitor the GitHub Security Advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv for patch availability. A definitive remediation will require either a vendor patch upgrading to a patched version of AVideo or replacement with an alternative video platform if patches are not forthcoming.