CVE-2026-34395 is a missing authorization vulnerability classified under CWE-862 affecting WWBN AVideo, an open-source video platform. In versions 26.0 and prior, the endpoint plugin/YPTWallet/view/users.json.php improperly authorizes access to sensitive user data. While it verifies that the requester is authenticated via User::isLogged(), it neglects to verify if the user has administrative privileges (User::isAdmin()). Consequently, any authenticated user can retrieve a JSON response containing the entire user database, including personal details and wallet balances. This exposure compromises user confidentiality and privacy. The vulnerability does not require user interaction beyond authentication and is remotely exploitable over the network with low attack complexity. The CVSS v3.1 base score is 6.5, reflecting a medium severity due to high confidentiality impact but no impact on integrity or availability. At the time of publication, no patches or mitigations have been officially released by WWBN. There are no known exploits in the wild, but the vulnerability poses a significant risk to platforms running vulnerable versions, especially those with large user bases or sensitive wallet data. The flaw highlights the importance of enforcing proper authorization checks beyond simple authentication in web application endpoints that expose sensitive data.

The primary impact of this vulnerability is the unauthorized disclosure of sensitive user information and wallet balances to any authenticated user on the platform. This breach of confidentiality can lead to privacy violations, identity theft, and financial information exposure. Organizations operating AVideo platforms risk reputational damage, loss of user trust, and potential regulatory penalties related to data protection laws such as GDPR or CCPA. Although the vulnerability does not affect data integrity or system availability, the exposure of wallet balances could facilitate targeted fraud or social engineering attacks. The ease of exploitation—requiring only valid user credentials—means that insider threats or compromised accounts can readily abuse this flaw. Platforms with large or high-value user bases are particularly vulnerable to significant data leakage. Until a patch is available, the risk of data exfiltration remains high, especially if attackers gain access to any user account.

Given the absence of official patches, organizations should implement immediate compensating controls. These include restricting access to the vulnerable endpoint via web application firewalls (WAFs) or network-level controls to allow only trusted administrative IPs. Review and tighten user role permissions to minimize the number of accounts with access to sensitive data. Monitor logs for unusual access patterns to the users.json.php endpoint or bulk data requests. Consider temporarily disabling or removing the YPTWallet plugin if feasible. Enforce strong authentication mechanisms and account monitoring to reduce the risk of compromised user credentials. Engage with WWBN for updates on patch releases and apply them promptly once available. Additionally, conduct security audits of other endpoints to ensure proper authorization checks are consistently implemented. Educate users about phishing and credential security to prevent account takeover.