CVE-2026-34395 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a broken access control caused by missing admin check in plugin/YPTWallet/view/users.json.php endpoint, letting any authenticated user access all users' personal and wallet information, exploit requires user authentication.

Severity & Score

Impact

Authenticated users can access all platform users' personal and wallet data, leading to significant information disclosure.

Mitigation

Update to the latest version when available or implement admin check on the endpoint.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-77jp-mgcw-rfmr

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner