What’s Vulnerable › Vulnerabilities

CVE-2026-34368: AVideo Vulnerable to Wallet Balance Double-Spend via TOCTOU Race Condition in transferBalance

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-03-27 · updated 2026-10-26
• Weakness: CWE-362

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `transferBalance()` method in `plugin/YPTWallet/YPTWallet.php` contains a Time-of-Check-Time-of-Use (TOCTOU) race condition. The method reads the sender's wallet balance, checks sufficiency in PHP, then writes the new balance — all without database transactions or row-level locking. An attacker with multiple authenticated sessions can send concurrent transfer requests that all read the same stale balance, each passing the balance check independently, resulting in only one deduction being applied while the recipient is credited multiple times. Commit 34132ad5159784bfc7ba0d7634bb5c79b769202d contains a fix.

Affected products

• WWBN AVideo: through 26.0

References

• https://github.com/WWBN/AVideo/commit/34132ad5159784bfc7ba0d7634bb5c79b769202d
• https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr
• https://github.com/WWBN/AVideo/security/advisories/GHSA-h54m-c522-h6qr

Get alerted when CVE-2026-34368 or the next vulnerability affects your stack