How severe is CVE-2026-35448?

CVE-2026-35448 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.

Is CVE-2026-35448 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2026-35448?

CVE-2026-35448 affects Wwbn Avideo. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2026-35448?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2026-35448 have an EU (EUVD) identifier?

Yes. CVE-2026-35448 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19529.

When was CVE-2026-35448 published?

CVE-2026-35448 was published on 2026-04-06 and last updated on 2026-06-17.

CVE-2026-35448

CVE-2026-35448 is a low-severity vulnerability in Wwbn Avideo with a CVSS 3.x base score of 3.7. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-862.

Key facts

Severity: Low (CVSS 3.x base score 3.7)
EPSS exploit prediction: 0% (24th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2026-19529
Weakness: CWE-862
Affected product: Wwbn Avideo
Published: 2026-04-06
Last modified: 2026-06-17

Description

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.

Frequently asked questions

What is CVE-2026-35448?: WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform.
How severe is CVE-2026-35448?: CVE-2026-35448 has a CVSS 3.x base score of 3.7, rated low severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is low, integrity none, and availability none.
Is CVE-2026-35448 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (24th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2026-35448?: CVE-2026-35448 affects Wwbn Avideo. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2026-35448?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2026-35448 have an EU (EUVD) identifier?: Yes. CVE-2026-35448 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2026-19529.
When was CVE-2026-35448 published?: CVE-2026-35448 was published on 2026-04-06 and last updated on 2026-06-17.

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9

Affected products (1)

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*

More vulnerabilities in Wwbn Avideo

CVE-2026-40911 — Critical (CVSS 10.0): WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server…
CVE-2026-33478 — Critical (CVSS 10.0): WWBN AVideo is an open source video platform. In versions up to and including 26.0, multiple vulnerabilities in…
CVE-2022-30547 — Critical (CVSS 9.9): A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master…
CVE-2026-41304 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the…
CVE-2026-33770 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `fixCleanTitle()` static method…
CVE-2026-33352 — Critical (CVSS 9.8): WWBN AVideo is an open source video platform. Prior to version 26.0, an unauthenticated SQL injection vulnerability…

All CVEs affecting Wwbn Avideo →

Other CWE-862 (Missing Authorization) vulnerabilities

CVE-2026-0092 — Critical (CVSS 10.0): In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could…
CVE-2026-33712 — Critical (CVSS 10.0): Typebot is a chatbot builder tool. In versions 3.15.2 and prior, the preview chat endpoint (POST…
CVE-2026-2031 — Critical (CVSS 10.0): An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration…
CVE-2026-34976 — Critical (CVSS 10.0): Dgraph is an open source distributed GraphQL database. Prior to 25.3.1, the restoreTenant admin mutation is missing…
CVE-2025-30416 — Critical (CVSS 10.0): Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis…
CVE-2025-45854 — Critical (CVSS 10.0): /server/executeExec of JEHC-BPM 2.0.1 allows attackers to execute arbitrary code via execParams.

Browse all CWE-862 (Missing Authorization) vulnerabilities →