Authentication Flaw in WWBN AVideo's StripeYPT Plugin Exposes Subscription Management

CVE-2026-34737

What is CVE-2026-34737?

The WWBN AVideo platform, a popular open-source video hosting solution, is susceptible to an authentication flaw in the StripeYPT plugin. In versions up to 26.0, a debug endpoint (test.php) is exposed to any logged-in user, contrary to best security practices that restrict such access to administrators. This vulnerability allows authenticated users to manipulate subscription data inappropriately, particularly through the retrieveSubscriptions() method. Instead of merely retrieving subscription information, the method inadvertently allows users to cancel Stripe subscriptions by entering a subscription ID. As of the latest information, there are no patches available to mitigate this risk, leaving users potentially vulnerable to unauthorized actions on their subscription accounts.

References