CVE-2026-34368

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34368", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T13:43:14.369Z", "datePublished": "2026-03-27T18:12:18.760Z", "dateUpdated": "2026-03-30T19:03:46.321Z"}, "containers": {"cna": {"title": "AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance", "problemTypes": [{"descriptions": [{"cweId": "CWE-362", "lang": "en", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr"}, {"name": "https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d", "tags": ["x_refsource_MISC"], "url": "https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T18:12:18.760Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance \u2014 all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix."}], "source": {"advisory": "GHSA-h54m-c522-h6qr", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-30T19:03:43.133606Z", "id": "CVE-2026-34368", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T19:03:46.321Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34368", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-30T19:03:43.133606Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-30T19:03:37.210Z"}}], "cna": {"title": "AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance", "source": {"advisory": "GHSA-h54m-c522-h6qr", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d", "name": "https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance \u2014 all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T18:12:18.760Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34368", "state": "PUBLISHED", "dateUpdated": "2026-03-30T19:03:46.321Z", "dateReserved": "2026-03-27T13:43:14.369Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T18:12:18.760Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance \u2014 all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el m\u00e9todo \u2019transferBalance()\u2019 en \u2019plugin/YPTWallet/YPTWallet.php\u2019 contiene una condici\u00f3n de carrera de tipo Time-of-Check-Time-of-Use (TOCTOU). El m\u00e9todo lee el saldo de la billetera del remitente, verifica la suficiencia en PHP, luego escribe el nuevo saldo - todo sin transacciones de base de datos ni bloqueo a nivel de fila. Un atacante con m\u00faltiples sesiones autenticadas puede enviar solicitudes de transferencia concurrentes que leen el mismo saldo obsoleto, cada una pasando la verificaci\u00f3n de saldo de forma independiente, resultando en que solo se aplique una deducci\u00f3n mientras el destinatario es acreditado varias veces. El commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contiene una soluci\u00f3n."}], "id": "CVE-2026-34368", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34368", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-30T19:03:43.133606Z", "version": "2.0.3"}}]}, "published": "2026-03-27T18:16:05.723", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-362"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-03-31T17:27:51.795236+00:00", "value": {"mitigation_remediation": ["Update AVideo to a version that includes the commit 34132ad5159784bfc7ba0d7634bb5c79b769202d or newer.", "If an immediate update is not possible, restrict concurrent usage of the transferBalance API by implementing rate limiting or session serialization to prevent simultaneous requests from the same user."], "summary": {"action": "Apply patch", "impact": "Unauthorized reallocation of wallet funds (double spending)"}, "threat_synthesis": {"affected_systems": "All installations of the WWBN AVideo platform running version 26.0 or earlier are affected. The issue is present in the YPTWallet plugin\u2019s transferBalance method within those releases. Upgrading to a later version that includes the patch (commit 34132ad5159784bfc7ba0d7634bb5c79b769202d or a release built from it) removes the race condition.", "description_and_impact": "The vulnerability resides in the transferBalance function of the AVideo platform\u2019s YPTWallet plugin, where a Time\u2011of\u2011Check\u2011Time\u2011of\u2011Use race condition allows a user with multiple authenticated sessions to initiate simultaneous transfers. Each transfer reads the sender\u2019s balance, verifies sufficient funds, and then writes the new balance without any locking mechanism. Because all concurrent requests read the same original balance, the balance check passes for each and only one deduction actually occurs, while the recipient receives the full amount multiple times. This can lead to the sender\u2019s wallet being drained and the recipient gaining funds in excess, effectively causing a double\u2011spend scenario.", "risk_and_exploitability": "The CVSS score of 5.3 places the vulnerability in the moderate range, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The attack requires an attacker to be authenticated within the affected AVideo installation and to coordinate multiple concurrent transfer requests, which is feasible but not trivial. The vulnerability is not listed in the CISA KEV catalog, so no undisclosed exploitation is known. As the weakness is a TOCTOU race condition (CWE\u2011362), the primary vector is through network requests that trigger the transferBalance function."}}}}, "created": "2026-03-27T20:27:51.432587+00:00", "updated": "2026-03-31T20:00:54.253962+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}