Vulnerability · Published Mar 31, 2026 · Assigned by GitHub_M

CVE-2026-34737AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

Medium 6.5

In plain English

A medium-severity missing authorization in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 78.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID. At time of publication, there are no publicly available patches.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-38rh-4v39-vfxv

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 26.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv x_refsource_CONFIRM