What is the CVSS score of EUVD-2026-17650?

EUVD-2026-17650 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for EUVD-2026-17650?

Yes, a patch is available for EUVD-2026-17650. Update the affected software to the latest version immediately.

PHP EUVD-2026-17650

| CVE-2026-34732 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-03-31 GitHub_M

GHSA-g2mg-cgr6-vmv7

Authentication Bypass Information Disclosure PHP

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17650

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:51 nvd

MEDIUM 5.3

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo CreatePlugin template for list.json.php does not include any authentication or authorization check. While the companion templates add.json.php and delete.json.php both require admin privileges, the list.json.php template was shipped without this guard. Every plugin that uses the CreatePlugin code generator inherits this omission, resulting in 21 unauthenticated data listing endpoints across the platform. These endpoints expose sensitive data including user PII, payment transaction logs, IP addresses, user agents, and internal system records. At time of publication, there are no publicly available patches.

AnalysisAI

WWBN AVideo 26.0 and prior exposes sensitive user data through 21 unauthenticated API endpoints via the CreatePlugin template generator. The list.json.php template lacks authentication checks present in its companion add.json.php and delete.json.php templates, allowing remote attackers to enumerate and retrieve user PII, payment logs, IP addresses, user agents, and internal system records without authentication. No vendor patch exists at time of analysis.

Technical ContextAI

WWBN AVideo is a PHP-based open-source video platform that uses a code generator (CreatePlugin) to scaffold API endpoints. The vulnerability stems from an authentication bypass (CWE-306: Missing Authentication Check) in the list.json.php template. While the add.json.php and delete.json.php templates implement admin privilege validation, the list.json.php template was shipped without equivalent guards. Because every plugin inheriting from the CreatePlugin code generator reuses this template, the authentication omission propagates across 21 endpoints. The affected product (CPE: cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*) indicates all versions through 26.0 are impacted. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) confirms the vulnerability is network-accessible, requires no authentication (PR:N), no user interaction, and results in a limited information disclosure impact.

RemediationAI

No vendor-released patch identified at time of analysis. Administrators should monitor the WWBN AVideo GitHub repository and security advisories for patched releases. Immediate mitigation options include: restrict network access to the affected list.json.php endpoints via web application firewall (WAF) rules or reverse proxy authentication, implement IP whitelisting to limit exposure to trusted networks, disable plugins not in active use to reduce the attack surface, and conduct a security audit of user data exposure logs to determine if the endpoints have been accessed without authorization. Until a patch is released, implement compensating authentication controls (e.g., reverse proxy authentication, API gateway token validation) in front of the plugin list.json.php endpoints. Refer to GitHub Security Advisory GHSA-g2mg-cgr6-vmv7 for updates.