What is the CVSS score of CVE-2026-34738?

CVE-2026-34738 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-34738?

Yes, a patch is available for CVE-2026-34738. Update the affected software to the latest version immediately.

Avideo CVE-2026-34738

EUVD-2026-17656 MEDIUM

Improper Authorization (CWE-285)

2026-03-31 GitHub_M

GHSA-m577-w9j8-ch7j

Authentication Bypass Avideo

4.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17656

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:55 nvd

MEDIUM 4.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

AnalysisAI

WWBN AVideo versions 26.0 and prior allow authenticated uploaders to bypass content moderation by directly setting video status to active via an unvalidated overrideStatus parameter, circumventing admin-controlled review workflows. The vulnerability affects any user with upload permissions and has a CVSS score of 4.3 (low-to-moderate severity) with no public exploit code identified at time of analysis.

Technical ContextAI

AVideo's video processing pipeline implements a setStatus() method that validates incoming status codes against a whitelist of permitted states (including 'active') but fails to perform authorization checks to ensure the caller has permission to transition a video to that state. This is a classic authorization bypass flaw (CWE-285: Improper Authorization) where business logic validation exists but privilege validation is absent. The vulnerability leverages the HTTP request parameter overrideStatus to inject status transitions directly into the video object lifecycle, bypassing the intended moderation and draft workflow states that admins control.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation options include: (1) restrict upload permissions to trusted users only until a patch is available; (2) implement server-side authorization checks in the setStatus() method to verify that only admins or designated moderators can change video status, particularly to 'active' state; (3) audit existing videos marked as 'active' to identify any that bypassed moderation; (4) monitor video status change logs for unauthorized transitions. Contact WWBN or monitor the GitHub Security Advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j) for patch availability and timeline.