Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.4

WWBN AVideo: Permanent WebSocket Access Through Expired Tokens

CVE-2026-34362 · published 7 months ago
Summary

A critical issue in WWBN AVideo versions up to 26.0 allows attackers to access sensitive data of all online users indefinitely. This is because token timeouts are not enforced, enabling captured tokens to provide permanent access. Update to version 26.1 or later to fix this issue.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
Ecosystem VendorProductAffected versions
composer wwbn avideo <= 26.0
Original advisory text
AVideo's WebSocket Token Never Expires Due to Commented-Out Timeout Validation in verifyTokenSocket()
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legitimately obtained tokens to provide permanent WebSocket access, even after user accounts are deleted, banned, or demoted from admin. Admin tokens grant access to real-time connection data for all online users including IP addresses, browser info, and page locations. Commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 fixes the issue.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
5.4 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-613Insufficient Session Expiration
Timeline
Published27 Mar 2026
Updated4 Nov 2026
First seen27 Mar 2026
Sources
CVE-2026-34362 · NVD
GHSA-2mg4-pfgx-64cf · GHSA
CVE-2026-34362 · OSV
Track software like this
Free during beta