WWBN AVideo up to 26.0 functions.php verifyTokenSocket session expiration

Summaryinfo

A vulnerability classified as critical was found in WWBN AVideo up to 26.0. The impacted element is the function verifyTokenSocket of the file plugin/YPTSocket/functions.php. The manipulation results in session expiration. This vulnerability is identified as CVE-2026-34362. The attack can be executed remotely. There is not any exploit available. Applying a patch is advised to resolve this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 26.0. It has been classified as critical. Affected is the function verifyTokenSocket of the file plugin/YPTSocket/functions.php. The manipulation with an unknown input leads to a session expiration vulnerability. CWE is classifying the issue as CWE-613. According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization." This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `verifyTokenSocket()` function in `plugin/YPTSocket/functions.php` has its token timeout validation commented out, causing WebSocket tokens to never expire despite being generated with a 12-hour timeout. This allows captured or legitimately obtained tokens to provide permanent WebSocket access, even after user accounts are deleted, banned, or demoted from admin. Admin tokens grant access to real-time connection data for all online users including IP addresses, browser info, and page locations. Commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 fixes the issue.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-34362 since 03/27/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are known technical details, but no exploit is available.

By approaching the search of inurl:plugin/YPTSocket/functions.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 5d5237121bf82c24e9e0fdd5bc1699f1157783c5 is able to eliminate this problem. The bugfix is ready for download at github.com.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 26.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion