PT-2026-28624 · Wwbn · Avideo

Adrgs · Publicado 2026-03-27 · Atualizado 2026-03-28 · CVE-2026-34374

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions up to and including 26.0

Description WWBN AVideo is an open source video platform. In versions up to and including 26.0, the Live schedule::keyExists() method builds a SQL query by directly inserting a stream key into the query string without proper parameterization. This occurs as a fallback mechanism from LiveTransmition::keyExists() when the primary, parameterized lookup fails. This bypasses the security measures of the initial lookup. The issue targets the stream key lookup used during RTMP publish authentication. Attackers may be able to access the entire user database through live streams. The Live schedule::keyExists() function is vulnerable.

Recommendations Versions up to and including 26.0 should be updated when a patched version becomes available. As a temporary workaround, consider disabling the Live schedule::keyExists() function until a patch is available.

Exploit

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

CVE-2026-34374

GHSA-XGV5-66WP-CH88

Produtos afetados

Avideo

Referências · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34374.json · Exploit
• https://github.com/WWBN/AVideo/security/advisories/GHSA-xgv5-66wp-ch88 · Aviso do Fabricante
• https://twitter.com/CveFindCom/status/2037616343650844992 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-34374 · Aviso do Fabricante
• https://twitter.com/TheHackerWire/status/2037635900147216501 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2037720420082757951 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2037719440918561014 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-34374 · Nota de Segurança
• https://twitter.com/TheHackerWire/status/2037651069048934518 · Publicação no Twitter
• https://twitter.com/0dayPublishing/status/2037600363843309595 · Publicação no Twitter