What is the CVSS score of EUVD-2026-16717?

EUVD-2026-16717 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by EUVD-2026-16717?

Organizations using versions should be aware of moderate risk from CVE-2026-34247, a missing authorization vulnerability rated CVSS 5.4. Attackers could gain access beyond their authorized level.

How to fix or mitigate EUVD-2026-16717?

Within 30 days: Identify affected systems running versions and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP EUVD-2026-16717

| CVE-2026-34247 MEDIUM

Missing Authorization (CWE-862)

2026-03-27 GitHub_M

GHSA-g3hj-mf85-679g

PHP Authentication Bypass

5.4

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 17:15 euvd

EUVD-2026-16717

Analysis Generated

Mar 27, 2026 - 17:15 vuln.today

CVE Published

Mar 27, 2026 - 16:39 nvd

MEDIUM 5.4

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the plugin/Live/uploadPoster.php endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary live_schedule_id. The endpoint only checks User::isLogged() but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a socketLiveOFFCallback notification containing the victim's broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.

AnalysisAI

WWBN AVideo versions up to 26.0 allow authenticated users to arbitrarily overwrite poster images for any scheduled live stream due to missing authorization checks in the uploadPoster.php endpoint, combined with subsequent broadcast of sensitive broadcast keys and user IDs to all connected WebSocket clients. An authenticated attacker can exploit this vulnerability without user interaction to deface another user's scheduled broadcasts and potentially harvest credential material for further attacks. No public exploit identified at time of analysis, though the vulnerability has been disclosed via GitHub security advisory with a published fix commit available.

Technical ContextAI

WWBN AVideo is an open-source video streaming platform implemented in PHP. The vulnerability exists in the plugin/Live/uploadPoster.php endpoint, which processes poster image uploads for scheduled live streams. The root cause is classified as CWE-862 (Missing Authorization), a common weakness in web applications where authentication (user login) is verified but authorization (user ownership/permission) is not. The affected CPE is cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*, indicating all versions in the 26.x line and earlier. The endpoint relies solely on User::isLogged() to validate requests, which confirms identity but does not verify that the authenticated user has legitimate access to the live_schedule_id parameter supplied in the request. The secondary exposure occurs through the WebSocket notification system (socketLiveOFFCallback), which broadcasts the victim's broadcast key and user ID to all connected clients without filtering or access controls, potentially leaking sensitive session identifiers.

RemediationAI

Upgrade WWBN AVideo to a version incorporating commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 or later (refer to the vendor's GitHub repository at https://github.com/WWBN/AVideo for the corresponding tagged release version). Until patching is possible, implement compensating controls by restricting direct access to the plugin/Live/uploadPoster.php endpoint at the web server or reverse proxy level to trusted administrative IP ranges, and audit WebSocket client access logs to detect unauthorized broadcast key leakage. Additionally, review the Live module's authorization model to ensure all user-modifiable resources (scheduled broadcasts, poster images, metadata) validate ownership before accepting modifications.