PT-2026-28622 · WordPress+1 · Yptwallet+1

Danielnetodotcom · Published 2026-03-27 · Updated 2026-03-30 · CVE-2026-34368

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The transferBalance() method within the plugin/YPTWallet/YPTWallet.php file contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks for sufficient funds using PHP, and then writes the new balance without utilizing database transactions or row-level locking. An attacker with multiple authenticated sessions can concurrently send transfer requests, each reading the same initial balance. These requests independently pass the balance check, leading to a scenario where the sender's balance is deducted only once, while the recipient receives funds multiple times. The vulnerable function is transferBalance().

Recommendations Versions up to and including 26.0 should be updated to a version containing commit 34132ad5159784bfc7ba0d7634bb5c79b769202d, which addresses the issue.

Exploit

Fix

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

CVE-2026-34368

GHSA-H54M-C522-H6QR

Affected Products

Avideo

Yptwallet

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34368.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr · Exploit
• https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-34368 · Security Note
• https://osv.dev/vulnerability/CVE-2026-34368 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h54m-c522-h6qr · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2037719444148125783 · Twitter Post
• https://twitter.com/cyberbivash/status/2037610095106814198 · Twitter Post
• https://twitter.com/infoflowcloud/status/2037720411555651931 · Twitter Post