The vulnerability in WWBN AVideo (CVE-2026-34362) arises from the verifyTokenSocket() function in plugin/YPTSocket/functions.php where token timeout validation is commented out. Although tokens are generated with a 12-hour timeout, the disabled validation causes tokens to never expire. This allows attackers or unauthorized users with captured or legitimate tokens to maintain persistent WebSocket access, bypassing account status changes such as deletion, banning, or admin demotion. Admin tokens grant access to sensitive real-time user connection data. The issue is addressed by commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5.

The vulnerability allows indefinite reuse of WebSocket tokens, enabling continued access to the WebSocket interface even after user accounts are deleted or permissions are revoked. This can lead to unauthorized access to real-time connection data, including IP addresses, browser details, and page locations, especially if admin tokens are compromised. The CVSS score of 5.4 reflects a medium severity with low impact on confidentiality and integrity, and no impact on availability.

A fix for this vulnerability exists as indicated by the referenced commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5. Users should update WWBN AVideo to a version that includes this commit or later. Since no official patch link is provided, users should consult the vendor or the project's repository for the updated code. Until patched, administrators should consider invalidating existing tokens and monitoring for unauthorized WebSocket access.