CVE-2026-34374

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34374", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-27T13:43:14.369Z", "datePublished": "2026-03-27T18:16:22.155Z", "dateUpdated": "2026-03-27T19:33:12.013Z"}, "containers": {"cna": {"title": "AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key", "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "lang": "en", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T18:16:22.155Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from `LiveTransmition::keyExists()` when the initial parameterized lookup returns no results. Although the calling function correctly uses parameterized queries for its own lookup, the fallback path to `Live_schedule::keyExists()` undoes this protection entirely. This vulnerability is distinct from GHSA-pvw4-p2jm-chjm, which covers SQL injection via the `live_schedule_id` parameter in the reminder function. This finding targets the stream key lookup path used during RTMP publish authentication. As of time of publication, no patched versions are available."}], "source": {"advisory": "GHSA-xgv5-66wp-ch88", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-27T19:33:00.474837Z", "id": "CVE-2026-34374", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T19:33:12.013Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34374", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-03-27T19:33:00.474837Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-27T19:33:07.864Z"}}], "cna": {"title": "AVideo has SQL Injection in Live_schedule::keyExists() via Unparameterized Stream Key", "source": {"advisory": "GHSA-xgv5-66wp-ch88", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from `LiveTransmition::keyExists()` when the initial parameterized lookup returns no results. Although the calling function correctly uses parameterized queries for its own lookup, the fallback path to `Live_schedule::keyExists()` undoes this protection entirely. This vulnerability is distinct from GHSA-pvw4-p2jm-chjm, which covers SQL injection via the `live_schedule_id` parameter in the reminder function. This finding targets the stream key lookup path used during RTMP publish authentication. As of time of publication, no patched versions are available."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-03-27T18:16:22.155Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34374", "state": "PUBLISHED", "dateUpdated": "2026-03-27T19:33:12.013Z", "dateReserved": "2026-03-27T13:43:14.369Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-03-27T18:16:22.155Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `Live_schedule::keyExists()` method constructs a SQL query by interpolating a stream key directly into the query string without parameterization. This method is called as a fallback from `LiveTransmition::keyExists()` when the initial parameterized lookup returns no results. Although the calling function correctly uses parameterized queries for its own lookup, the fallback path to `Live_schedule::keyExists()` undoes this protection entirely. This vulnerability is distinct from GHSA-pvw4-p2jm-chjm, which covers SQL injection via the `live_schedule_id` parameter in the reminder function. This finding targets the stream key lookup path used during RTMP publish authentication. As of time of publication, no patched versions are available."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En versiones hasta la 26.0 inclusive, el m\u00e9todo \u2019Live_schedule::keyExists()\u2019 construye una consulta SQL interpolando una clave de transmisi\u00f3n directamente en la cadena de consulta sin parametrizaci\u00f3n. Este m\u00e9todo es llamado como un mecanismo de respaldo desde \u2019LiveTransmition::keyExists()\u2019 cuando la b\u00fasqueda parametrizada inicial no devuelve resultados. Aunque la funci\u00f3n que llama utiliza correctamente consultas parametrizadas para su propia b\u00fasqueda, la ruta de respaldo a \u2019Live_schedule::keyExists()\u2019 deshace esta protecci\u00f3n por completo. Esta vulnerabilidad es distinta de GHSA-pvw4-p2jm-chjm, que cubre la inyecci\u00f3n SQL a trav\u00e9s del par\u00e1metro \u2019live_schedule_id\u2019 en la funci\u00f3n de recordatorio. Este hallazgo se dirige a la ruta de b\u00fasqueda de la clave de transmisi\u00f3n utilizada durante la autenticaci\u00f3n de publicaci\u00f3n RTMP. Al momento de la publicaci\u00f3n, no hay versiones parcheadas disponibles."}], "id": "CVE-2026-34374", "lastModified": "2026-10-26T22:10:00.163", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.1, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.2, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34374", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-03-27T19:33:00.474837Z", "version": "2.0.3"}}]}, "published": "2026-03-27T19:16:42.930", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-03-31T20:22:44.556643+00:00", "value": {"mitigation_remediation": ["Contact WWBN for a patch release or upstream fix.", "If a patch is not available, modify Live_schedule::keyExists() to use parameterized queries or reject non\u2011alphanumeric stream keys.", "Disable or restrict the RTMP publish endpoint to trusted sources only.", "Monitor authentication logs for abnormal stream keys or SQL errors.", "Keep the system isolated from public networks until a fix is applied."], "summary": {"action": "Immediate Patch", "impact": "Data Breach and Potential Account Compromise"}, "threat_synthesis": {"affected_systems": "All installations of WWBN AVideo up to and including version\u202f26.0 are affected. The issue remains in the core Live_schedule module and is triggered when the fallback lookup for stream keys is used during RTMP authentication. No patched release is available at the time of publication, so any site running a vulnerable version and allowing public RTMP publishing is at risk.", "description_and_impact": "The vulnerability is an unparameterized SQL injection in the Live_schedule::keyExists() method of the WWBN AVideo platform. During RTMP publish authentication, the stream key supplied by the broadcaster is inserted directly into a SQL statement without escaping or parameterization. This allows an attacker to inject arbitrary SQL, potentially reading, modifying, or deleting data related to live schedules or bypassing authentication. The weakness aligns with CWE\u201189.", "risk_and_exploitability": "The CVSS base score of 9.1 indicates a severe risk. EPSS indicates a low probability of exploitation at the moment (<1\u202f%), and the vulnerability is not listed in the CISA KEV catalog. However, the attack path is remote and requires only a crafted stream key that can be sent over the RTMP publish channel, making it potentially accessible to anyone who can broadcast to the server. The lack of privileged prerequisites means that a normal user could leverage the flaw, emphasizing the urgency of an immediate fix."}}}}, "created": "2026-03-27T20:27:48.706100+00:00", "updated": "2026-04-02T07:55:30.381507+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}