Platform
php
Component
wwbn/avideo
Fixed in
26.0.1
26.0.1
CVE-2026-34738 is a security vulnerability affecting the wwbn/avideo component where the video processing pipeline allows unauthorized users to modify a video's status, bypassing moderation workflows. This enables any user with upload permissions to directly publish videos, circumventing content review processes and potentially leading to the dissemination of unapproved content. The vulnerability impacts versions of wwbn/avideo up to 26.0. No official patch is currently available.
CVE-2026-34738 in AVideo allows any uploader with permissions to directly set a video's status to 'active' (a), bypassing admin-controlled moderation and draft workflows. This is because the setStatus() method validates the status code against a predefined list but does not verify if the caller has permission to set that particular status. An attacker could exploit this flaw to publish inappropriate or unapproved content, negatively impacting the platform's quality and security. The absence of a fix available exacerbates the risk, as the vulnerability remains open to exploitation.
An attacker with upload permissions in AVideo can exploit this vulnerability by sending an overrideStatus request with the value 'a' (active). Due to insufficient permission validation, the request will be processed without proper authorization, allowing the attacker to publish videos directly, bypassing the moderation process. The ease of exploitation lies in the simplicity of the request and the lack of adequate access controls. Exploitation could be automated, enabling the mass publication of unwanted content.
Exploit Status
EPSS
0.03% (7% percentile)
CISA SSVC
Given that no official fix is provided, immediate mitigation focuses on implementing stricter access controls within the setStatus() method. This involves verifying the user's identity and permissions before allowing any status changes. A thorough audit of the code related to video status management is recommended to identify and rectify any other potential authorization failures. Furthermore, implementing detailed logging of status changes can aid in detecting and responding to exploitation attempts. Consider temporarily disabling the status change functionality until a proper solution is implemented.
Actualizar AVideo a una versión posterior a la 26.0, una vez que se publique un parche. Como medida temporal, revisar y moderar manualmente todos los videos subidos para asegurar que el contenido sea apropiado antes de publicarlo.
Vulnerability analysis and critical alerts directly to your inbox.
It's a unique identifier for this specific vulnerability in AVideo.
It could allow the publication of inappropriate or unapproved content, impacting the platform's quality.
Currently, no official fix is provided by AVideo. Mitigation measures are recommended.
Implement stricter access controls and audit the code related to video status management.
Monitor AVideo's communication channels and vulnerability databases like NVD.
CVSS Vector
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.