CVE-2026-34732 identifies a missing authentication vulnerability (CWE-306) in the WWBN AVideo open source platform, specifically in the CreatePlugin template's list.json.php endpoint. Unlike related endpoints that enforce admin privileges, this endpoint allows unauthenticated access to sensitive data listings. Since every plugin using the CreatePlugin code generator inherits this flaw, there are 21 such unauthenticated data listing endpoints across the platform. The exposed data includes user PII, payment transaction logs, IP addresses, user agents, and internal system records. The vulnerability affects versions 26.0 and prior. No official patches or fixes have been published as of the vulnerability disclosure date.

The vulnerability allows unauthenticated attackers to access sensitive information without any privilege requirements. Exposed data includes personally identifiable information, payment transaction logs, and internal system details, which could lead to privacy violations and information disclosure risks. There is no indication of integrity or availability impact. The CVSS 3.1 base score is 5.3 (medium severity), reflecting the confidentiality impact with no required privileges or user interaction.

At the time of disclosure, no official patches or fixes are available. Users of WWBN AVideo versions 26.0 and earlier should monitor the vendor's advisories for updates. Until a fix is released, restricting access to the affected endpoints through network controls or web application firewalls may reduce exposure. Avoid deploying plugins generated with the vulnerable CreatePlugin template or audit and modify the code to enforce proper authentication on list.json.php endpoints.