Avideo CVE-2026-34737

The CVSS v3.1 score of 6.5 (Medium severity) reflects moderate real-world risk: the attack vector is Network (AV:N) and complexity is Low (AC:L), but exploitation requires authenticated access (PR:L), which limits the attacker population to users with valid login credentials. The integrity impact (I:H) is significant-attackers can cancel revenue-generating subscriptions-though confidentiality and availability are not directly affected. The EPSS score and exploitation probability data are not provided, but the lack of publicly available exploit code and absence of KEV (CISA Known Exploited Vulnerabilities) designation suggest this is not yet a widespread threat. However, the low technical complexity (AC:L) and straightforward exploitation method (HTTP request to test.php with a subscription ID) mean that motivated threat actors with legitimate or compromised user accounts pose a meaningful risk. The primary constraint is the authentication requirement: this is not remotely exploitable without valid credentials, significantly reducing real-world attack surface compared to unauthenticated RCE or SQL injection. This is a genuine priority for organizations running AVideo with Stripe integration and multiple user accounts, but lower urgency than critical unauthenticated vulnerabilities.

An attacker with valid credentials to an AVideo instance (either through account registration or compromised credentials) authenticates and sends a crafted HTTP request to the StripeYPT plugin's test.php endpoint with a Stripe subscription ID and cancellation payload. The endpoint, due to missing administrator authorization checks, processes the request and the vulnerable retrieveSubscriptions() method executes the cancellation instead of merely fetching subscription data. Within seconds, the target subscription is cancelled in Stripe, immediately halting recurring payments to the platform operator. The attacker repeats this for multiple subscription IDs to maximize damage. Low technical complexity and no interactive user steps make this a straightforward exploit for any authenticated user, though the requirement for valid login credentials significantly limits exploitation to insider threats or accounts compromised via credential stuffing or phishing.