WebSocket Token Management Vulnerability in AVideo by WWBN

CVE-2026-34362

What is CVE-2026-34362?

The AVideo platform has a critical issue in its token management for WebSocket connections, found in versions up to and including 26.0. The vulnerability lies in the verifyTokenSocket() function, where the timeout validation for WebSocket tokens is commented out. As a result, tokens that should expire after 12 hours remain valid indefinitely, allowing unauthorized access to users’ WebSocket connections. This leads to a significant security risk, as even after user accounts are deleted or demoted, their tokens can still be used to access real-time connection data, including sensitive information such as IP addresses and browser details. This issue has been rectified in commit 5d5237121bf82c24e9e0fdd5bc1699f1157783c5.

References