PT-2026-28623 · Avideo · Avideo

Offset · Published 2026-03-27 · Updated 2026-03-31 · CVE-2026-34369

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions up to and including 26.0

Description AVideo is an open source video platform. The get api video file and get api video API endpoints do not verify video passwords for password-protected videos. This allows an unauthenticated attacker to retrieve direct playback URLs for any password-protected video by directly calling the API. The normal web playback flow enforces password checks via the CustomizeUser::getModeYouTube() hook, but this enforcement is absent from the API code path. The issue is addressed by commit be344206f2f461c034ad2f1c5d8212dd8a52b8c7.

Recommendations Update AVideo to a version later than 26.0.

Exploit

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-34369

GHSA-Q6JJ-R49P-94FH

Affected Products

Avideo

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34369.json · Exploit
• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-q6jj-r49p-94fh · Exploit
• https://github.com/WWBN/AVideo/commit/be344206f2f461c034ad2f1c5d8212dd8a52b8c7 · Patch
• https://osv.dev/vulnerability/CVE-2026-34369 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-34369 · Security Note
• https://osv.dev/vulnerability/GHSA-q6jj-r49p-94fh · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://twitter.com/CVEnew/status/2037719443095388568 · Twitter Post
• https://reddit.com/r/VulnMatter/comments/1s8lx07/resumen_diario_de_vulnerabilidades_31032026 · Reddit Post
• https://twitter.com/infoflowcloud/status/2037720396493918391 · Twitter Post