PT-2026-28620 · Avideo · Yptsocket+1

Offset · Published 2026-03-27 · Updated 2026-03-30 · CVE-2026-34362

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description A flaw exists in AVideo where WebSocket tokens do not expire as intended due to a commented-out timeout validation within the verifyTokenSocket() function located in plugin/YPTSocket/functions.php. Tokens, generated with a 12-hour timeout, remain valid indefinitely, even after user accounts are deleted, banned, or demoted. Admin tokens grant access to real-time connection data for all online users, including IP addresses, browser information, and page locations. The getEncryptedInfo() function generates tokens with a 12-hour expiration using getToken(43200). The isAdmin claim within the token allows for amplification of the impact, as demoted administrators can retain permanent admin-level WebSocket access. The getClientsList message type allows users to enumerate connected users. The 10-minute inactivity timeout does not mitigate the issue.

Recommendations Uncomment the timeout enforcement in verifyTokenSocket() at plugin/YPTSocket/functions.php:77-80.

Exploit

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

CVE-2026-34362

GHSA-2MG4-PFGX-64CF

Affected Products

Avideo

Yptsocket

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34362.json · Exploit
• https://github.com/WWBN/AVideo/commit/5d5237121bf82c24e9e0fdd5bc1699f1157783c5 · Patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-2mg4-pfgx-64cf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-34362 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34362 · Security Note
• https://osv.dev/vulnerability/GHSA-2mg4-pfgx-64cf · Vendor Advisory
• https://github.com/WWBN/AVideo · Note