CVE-2026-34247

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim's broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/WWBN/AVideo/commit/5fcb3bdf59f26d65e203cfbc8a685356ba300b60	Patch
https://github.com/WWBN/AVideo/security/advisories/GHSA-g3hj-mf85-679g	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) WWBN AVideo es una plataforma de vídeo de código abierto. En versiones hasta la 26.0 inclusive, el endpoint ’plugin/Live/uploadPoster.PHP’ permite a cualquier usuario autenticado sobrescribir la imagen de póster para cualquier transmisión en vivo programada al proporcionar un ’live_schedule_id’ arbitrario. El endpoint solo verifica ’User::isLogged()’ pero nunca verifica que el usuario autenticado sea propietario de la programación objetivo. Después de sobrescribir el póster, el endpoint difunde una notificación ’socketLiveOFFCallback’ que contiene la clave de transmisión y el ID de usuario de la víctima a todos los clientes WebSocket conectados. El commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 corrige el problema.

Information

Published : 2026-03-27 17:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34247

Mitre link : CVE-2026-34247

CVE.ORG link : CVE-2026-34247

JSON object : View

Products Affected

wwbn

avideo

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-34247", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34247", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T17:29:06.093501Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 2.8}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}]}], "published": "2026-03-27T17:16:30.213", "references": [{"url": "https://github.com/WWBN/AVideo/commit/5fcb3bdf59f26d65e203cfbc8a685356ba300b60", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-g3hj-mf85-679g", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `plugin/Live/uploadPoster.php` endpoint allows any authenticated user to overwrite the poster image for any scheduled live stream by supplying an arbitrary `live_schedule_id`. The endpoint only checks `User::isLogged()` but never verifies that the authenticated user owns the targeted schedule. After overwriting the poster, the endpoint broadcasts a `socketLiveOFFCallback` notification containing the victim's broadcast key and user ID to all connected WebSocket clients. Commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 fixes the issue."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de v\u00eddeo de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el endpoint \u2019plugin/Live/uploadPoster.PHP\u2019 permite a cualquier usuario autenticado sobrescribir la imagen de p\u00f3ster para cualquier transmisi\u00f3n en vivo programada al proporcionar un \u2019live_schedule_id\u2019 arbitrario. El endpoint solo verifica \u2019User::isLogged()\u2019 pero nunca verifica que el usuario autenticado sea propietario de la programaci\u00f3n objetivo. Despu\u00e9s de sobrescribir el p\u00f3ster, el endpoint difunde una notificaci\u00f3n \u2019socketLiveOFFCallback\u2019 que contiene la clave de transmisi\u00f3n y el ID de usuario de la v\u00edctima a todos los clientes WebSocket conectados. El commit 5fcb3bdf59f26d65e203cfbc8a685356ba300b60 corrige el problema."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}