Is CVE-2026-34368 actively exploited?

CVE-2026-34368 has no public evidence of in-the-wild exploitation as of 2026-03-31.

What is the CVSS score for CVE-2026-34368?

CVE-2026-34368 has a CVSS score of 5.3 (MEDIUM severity). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N.

How do I patch CVE-2026-34368?

Patch guidance is available from wwbn security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2026-34368.

CVE-2026-34368 - remediation guidance & executive summary

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Attack Vector: network
Complexity: high
Privileges: low
User Action: none
Scope: unchanged
Confidentiality: none
Integrity: high
Availability: none
Weaknesses: CWE-362 · Race Condition

Metadata

Primary Vendor: WWBN
Published: 3/27/2026
Last Modified: 3/31/2026
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

wwbn : avideo

Remediation Guidance

Executive Summary

Cite this page

CVE-2026-34368. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2026-34368

View on NIST NVD

CVE-2026-34368 vulnerability