CVE-2026-34368 json
AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance
published 2026-03-27 7 mo ago modified 2026-10-26 13 d ago also GHSA-h54m-c522-h6qr , EUVD-2026-16734
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.2%
- EPSS 0.2% chance of exploitation in 30 days, percentile 14%
- public exploits
- 0
- none known
Summary
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.24% chance of exploitation in the next 30 days, higher than 14% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <=26.0 |
no fix listed |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
References
-
github.com
/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d
web, patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr
exploit, web, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34368
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-34368
- GitHub Advisory GHSA-h54m-c522-h6qr
- NVD CVE-2026-34368
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.