---
id: CVE-2026-34738
title: WWBN AVideo is an open source video platform
summary: >-
  WWBN AVideo is an open source video platform. In versions 26.0 and prior,
  AVideo's video processing pipeline accepts an overrideStatus request parameter
  that allows any uploader to set a video's status to any valid state, including
  "acti…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cwe:
  - CWE-285
vendor: wwbn
product: avideo
affected:
  - avideo <= 26.0
published: '2026-03-31'
updated: '2026-07-24'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-34738'
references:
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j'
    label: security-advisories@github.com
  - url: 'https://github.com/WWBN/AVideo/security/advisories/GHSA-m577-w9j8-ch7j'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
epss: 0.00275
epssPercentile: 0.17771
ingestedAt: '2026-07-25T21:03:57.775Z'
---

## Overview

WWBN AVideo is an open source video platform. In versions 26.0 and prior, AVideo's video processing pipeline accepts an overrideStatus request parameter that allows any uploader to set a video's status to any valid state, including "active" (a). This bypasses the admin-controlled moderation and draft workflows. The setStatus() method validates the status code against a list of known values but does not verify that the caller has permission to set that particular status. As a result, any user with upload permissions can publish videos directly, circumventing content review processes. At time of publication, there are no publicly available patches.

## Affected

- `avideo <= 26.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.