Avideo EUVD-2026-16734

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N) assigns a base score of 5.3, reflecting network accessibility, high attack complexity, low privilege requirement, and high integrity impact with no confidentiality or availability concerns. The AC:H (high complexity) rating acknowledges the technical difficulty of reliably triggering concurrent requests, which mitigates the raw severity. However, the integrity impact is rated high because successful exploitation directly results in unauthorized balance multiplication-a direct violation of transaction consistency. The PR:L requirement (low privilege) limits the threat to authenticated users, reducing overall attack surface compared to unauthenticated vulnerabilities. From a prioritization perspective, this vulnerability represents moderate real-world risk: while the integrity impact is severe for systems managing financial or premium content access, the requirement for multiple authenticated sessions, precise timing, and inherent race condition unpredictability reduce practical exploitability. Organizations using AVideo for non-critical wallet features or those with low concurrent user volumes face lower risk. No public exploit code or confirmed active exploitation has been reported, suggesting this is not yet a weaponized threat. Organizations hosting AVideo with high-value wallet systems or frequent concurrent transactions should prioritize patching; others may apply standard patch management cycles.

An authenticated attacker opens two simultaneous browser tabs or API connections to their AVideo wallet. They initiate a balance transfer of their entire wallet balance to a target account in both tabs within milliseconds, before either request's database write completes. Both requests read the original balance (e.g., 1000 credits), both pass the validation check, and both write updated balances to their own recipient accounts. The attacker's balance is decremented once (resulting in a final deduction that may be 1000 or partially applied), but the recipient receives the credit twice or more depending on timing, effectively duplicating value. This requires precise timing (AC:H) but is feasible via scripted concurrent requests to an API endpoint.