CVE-2026-34245: Wwbn Avideo Privilege Escalation Flaw

CVE-2026-34245 Overview

CVE-2026-34245 is a Broken Access Control vulnerability affecting WWBN AVideo, an open source video platform. In versions up to and including 26.0, the plugin/PlayLists/View/Playlists_schedules/add.json.php endpoint allows any authenticated user with streaming permission to create or modify broadcast schedules targeting any playlist on the platform, regardless of ownership. When the schedule executes, the rebroadcast runs under the victim playlist owner's identity, allowing content hijacking and stream disruption.

Critical Impact

Authenticated attackers can hijack broadcast schedules and run rebroadcasts under other users' identities, enabling content manipulation and stream disruption across the platform.

Affected Products

• WWBN AVideo versions up to and including 26.0
• Any deployment using the PlayLists plugin with scheduling functionality

Discovery Timeline

• 2026-03-27 - CVE-2026-34245 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2026-34245

Vulnerability Analysis

This vulnerability represents a classic Broken Access Control flaw (CWE-862: Missing Authorization) where the application fails to verify resource ownership before allowing modifications. The vulnerable endpoint plugin/PlayLists/View/Playlists_schedules/add.json.php checks only whether a user has streaming permissions via the User::canStream() function, but completely omits validation that the user owns or has legitimate access to the target playlist.

The security flaw allows any authenticated user with basic streaming permissions to manipulate broadcast schedules for playlists they do not own. When these schedules execute, the rebroadcast operations run under the context of the playlist owner rather than the attacker, creating an identity confusion scenario that can be exploited for content hijacking.

Root Cause

The root cause is the absence of ownership verification in the playlist schedule management endpoint. The code only validates that the PlayLists plugin is enabled and that the user has streaming capabilities, but never confirms whether the authenticated user has authority over the playlists_id parameter being submitted. This allows horizontal privilege escalation where users can operate on resources belonging to other users at the same permission level.

Attack Vector

The attack can be executed remotely over the network by any authenticated user with streaming permissions. The attacker crafts a POST request to the vulnerable endpoint specifying a playlists_id belonging to another user. The low complexity of exploitation combined with no required user interaction makes this a straightforward authorization bypass attack.

The vulnerable code removed in the patch demonstrates the issue:

-<?php
-header('Content-Type: application/json');
-require_once '../../../../videos/configuration.php';
-require_once $global['systemRootPath'] . 'plugin/PlayLists/Objects/Playlists_schedules.php';
-$obj = new stdClass();
-$obj->error = true;
-$obj->msg = "";
-
-$plugin = AVideoPlugin::loadPluginIfEnabled('PlayLists');
-if (empty($plugin)) {
-    forbiddenPage(__("The plugin is disabled"));
-}
-                                           
-if (!User::canStream()) {
-    forbiddenPage(__("You cannot livestream"));
-}
-
-$o = new Playlists_schedules(@$_POST['id']);
-$o->setPlaylists_id($_POST['playlists_id']);
-$o->setName($_POST['name']);
-$o->setDescription($_POST['description']);
-//$o->setStatus($_POST['status']);
-$o->setLoop($_POST['loop']);
-$o->setStart_datetime($_POST['start_datetime']);
-$o->setFinish_datetime($_POST['finish_datetime']);
-$o->setRepeat($_POST['repeat']);
-$o->setParameters($_POST['parameters']);
-
-if($id = $o->save()){
-    $obj->error = false;

Source: GitHub Commit Update

Detection Methods for CVE-2026-34245

Indicators of Compromise

• Unexpected broadcast schedule modifications appearing in playlist management interfaces
• Scheduled broadcasts created for playlists by users who do not own those playlists
• Audit logs showing POST requests to plugin/PlayLists/View/Playlists_schedules/add.json.php with mismatched user and playlist ownership
• Stream disruptions or unauthorized content appearing on victim playlist owners' channels

Detection Strategies

• Monitor HTTP access logs for POST requests to the vulnerable endpoint from users accessing playlists they do not own
• Implement application-level logging to track playlist schedule modifications and correlate with user ownership records
• Deploy web application firewall rules to flag cross-account playlist schedule modification attempts

Monitoring Recommendations

• Enable detailed access logging for all playlist management endpoints
• Implement alerting for schedule modifications on high-value or verified user playlists
• Review scheduled broadcast logs periodically for anomalous patterns indicating unauthorized access

How to Mitigate CVE-2026-34245

Immediate Actions Required

• Upgrade WWBN AVideo to a version containing commit 1e6dc20172de986f60641eb4fdb4090f079ffdce or later
• Review recent broadcast schedule modifications for signs of unauthorized access
• Audit user accounts with streaming permissions for suspicious activity
• Consider temporarily disabling the playlist scheduling feature until patched

Patch Information

The vulnerability has been addressed in commit 1e6dc20172de986f60641eb4fdb4090f079ffdce. The patch adds proper ownership verification for editing and managing playlists in the add.json.php endpoint. Organizations should apply this fix by updating to a patched version of AVideo.

For more details, see the GitHub Security Advisory and the GitHub Commit Update.

Workarounds

• Restrict streaming permissions to only trusted users until the patch is applied
• Implement network-level access controls to limit access to the vulnerable endpoint
• Deploy a web application firewall rule to validate playlist ownership on schedule modification requests

# Example: Restrict access to the vulnerable endpoint at the web server level
# Apache configuration to temporarily block the endpoint
<Location "/plugin/PlayLists/View/Playlists_schedules/add.json.php">
    Require all denied
</Location>