CVE-2026-34732: Wwbn Avideo Auth Bypass Vulnerability

CVE-2026-34732 Overview

WWBN AVideo is an open source video platform that contains a critical authentication bypass vulnerability in its CreatePlugin template system. In versions 26.0 and prior, the list.json.php template does not include any authentication or authorization checks. While companion templates add.json.php and delete.json.php both require admin privileges, the list.json.php template was shipped without this guard. Every plugin that uses the CreatePlugin code generator inherits this omission, resulting in 21 unauthenticated data listing endpoints across the platform.

Critical Impact
Unauthenticated attackers can access 21 sensitive data listing endpoints exposing user PII, payment transaction logs, IP addresses, user agents, and internal system records without any authentication.

Affected Products

WWBN AVideo version 26.0 and prior
All plugins using the CreatePlugin code generator
AVideo platforms with exposed list.json.php endpoints

Discovery Timeline

2026-03-31 - CVE-2026-34732 published to NVD
2026-04-01 - Last updated in NVD database

Technical Details for CVE-2026-34732

Vulnerability Analysis

This vulnerability stems from CWE-306 (Missing Authentication for Critical Function), a fundamental security design flaw in the AVideo platform's plugin architecture. The CreatePlugin template system was designed to generate consistent CRUD (Create, Read, Update, Delete) functionality for plugins, but an inconsistent security implementation left the read/list functionality unprotected.

The vulnerable list.json.php template returns JSON-formatted data from plugin database tables without verifying the requester's identity or authorization level. Since this template serves as the foundation for 21 different plugin endpoints throughout the platform, the security gap propagates across the entire application ecosystem.

Attackers exploiting this vulnerability gain access to highly sensitive information including personally identifiable information (PII) of users, complete payment transaction histories, IP addresses and user agent strings that could facilitate further attacks, and internal system records that reveal platform configuration details.

Root Cause

The root cause is an inconsistent security implementation in the CreatePlugin code generator. When the template system was developed, authentication guards were properly implemented for destructive operations (add.json.php and delete.json.php) but were inadvertently omitted from the data retrieval template (list.json.php). This oversight created a pattern where every plugin generated using this framework inherits the same authentication bypass vulnerability.

Attack Vector

The attack vector is network-based and requires no authentication, privileges, or user interaction. An attacker can directly access any of the 21 vulnerable endpoints by crafting HTTP requests to the list.json.php endpoints of installed plugins.

The exploitation is straightforward: an attacker sends unauthenticated HTTP GET requests to vulnerable plugin endpoints such as /plugin/[plugin_name]/list.json.php. The server responds with JSON-formatted data containing sensitive information without verifying the requester's authorization. The attacker can enumerate all 21 affected endpoints by examining the platform's plugin structure or through automated scanning, extracting user data, payment records, and system information with each successful request.

Detection Methods for CVE-2026-34732

Indicators of Compromise

Unusual access patterns to list.json.php endpoints from external IP addresses
High-volume requests to multiple plugin list endpoints in short time periods
Access logs showing unauthenticated requests returning large JSON responses
Requests to plugin endpoints from IP addresses not associated with legitimate users

Detection Strategies

Implement web application firewall rules to monitor access to */list.json.php endpoints
Configure log analysis to alert on unauthenticated access to plugin JSON endpoints
Deploy rate limiting on sensitive data endpoints to detect enumeration attempts
Monitor for bulk data extraction patterns across multiple plugin endpoints

Monitoring Recommendations

Review web server access logs for requests matching the pattern /plugin/*/list.json.php
Establish baseline metrics for legitimate API usage to identify anomalous access patterns
Enable detailed logging on all CreatePlugin-generated endpoints
Configure SIEM rules to correlate multiple endpoint accesses from single source IPs

How to Mitigate CVE-2026-34732

Immediate Actions Required

Restrict access to all list.json.php endpoints using web server configuration or WAF rules
Implement network-level access controls to limit exposure of plugin endpoints
Audit access logs to determine if exploitation has already occurred
Consider temporarily disabling non-essential plugins until patches are available

Patch Information

At time of publication, there are no publicly available patches for this vulnerability. Organizations should monitor the WWBN AVideo Security Advisory for updates on official remediation.

Workarounds

Add authentication checks manually to all list.json.php files in installed plugins
Use reverse proxy or WAF rules to require authentication for all plugin JSON endpoints
Implement IP allowlisting to restrict access to administrative and data endpoints
Deploy API gateway controls to enforce authentication on all plugin routes

bash

# Example Apache .htaccess restriction for plugin endpoints
<FilesMatch "list\.json\.php$">
    Require all denied
    # Or restrict to specific IPs
    # Require ip 192.168.1.0/24
</FilesMatch>