WWBN AVideo up to 26.0 Transaction YPTWallet.php transferBalance race condition

Summaryinfo

A vulnerability, which was classified as problematic, was found in WWBN AVideo up to 26.0. This impacts the function transferBalance of the file plugin/YPTWallet/YPTWallet.php of the component Transaction Handler. Such manipulation leads to race condition. This vulnerability is listed as CVE-2026-34368. The attack may be performed from remote. There is no available exploit. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in WWBN AVideo up to 26.0. It has been rated as problematic. Affected by this issue is the function transferBalance of the file plugin/YPTWallet/YPTWallet.php of the component Transaction Handler. The manipulation with an unknown input leads to a race condition vulnerability. Using CWE to declare the problem leads to CWE-362. The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently. Impacted is integrity. CVE summarizes:

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix.

The advisory is available at github.com. This vulnerability is handled as CVE-2026-34368 since 03/27/2026. The exploitation is known to be difficult. The attack may be launched remotely. Technical details are known, but there is no available exploit.

By approaching the search of inurl:plugin/YPTWallet/YPTWallet.php it is possible to find vulnerable targets with Google Hacking.

Applying the patch 34132ad5159784bfc7ba0d7634bb5c79b769202d is able to eliminate this problem. The bugfix is ready for download at github.com.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• WWBN

Name

• AVideo

Version

• 26.0

License

• open-source

Website

• Product: https://github.com/WWBN/AVideo/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion