CVE-2026-34368 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix.
A Time-of-Check-Time-of-Use (TOCTOU) race condition vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the 'transferBalance()' method of 'plugin/YPTWallet/YPTWallet.php', where the absence of database transactions or row-level locking allows an attacker with multiple authenticated sessions to exploit concurrent transfer requests. Each request reads the same outdated wallet balance, independently passes the balance verification, and results in only one deduction while the recipient is credited multiple times. This vulnerability can lead to unauthorized wallet balance inflation and financial discrepancies within the platform.
The vulnerability has been patched in commit 34132ad5159784bfc7ba0d7634bb5c79b769202d, which includes a fix for the race condition by implementing database transactions and row-level locking in the 'transferBalance()' method.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 31, 2026 | Initial Analysis | [email protected] |
| Mar 30, 2026 | CVE Modified | CISA-ADP |
| Mar 27, 2026 | New CVE Received | [email protected] |