CVE-2026-34737 json
AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug
published 2026-03-31 7 mo ago modified 2026-07-24 3 mo ago also EUVD-2026-17654 , GHSA-38rh-4v39-vfxv
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 21%
- public exploits
- 0
- none known
Summary
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. At time of publication, there are no publicly available patches.
Patch / fix
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.29% chance of exploitation in the next 30 days, higher than 21% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
| GitHub | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <=26.0 |
no fix listed |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
github.com
/WWBN/AVideo/commit/8ac79b9375872f02f72999157b19a40c17126513
web
-
github.com
/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv
web, exploit, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-34737
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-34737
- GitHub Advisory GHSA-38rh-4v39-vfxv
- NVD CVE-2026-34737
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.