CVE-2026-34737: AVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug

April 1, 2026

The StripeYPT plugin includes a test.php debug endpoint that is accessible to any logged-in user, not just administrators. This endpoint processes Stripe webhook-style payloads and triggers subscription operations, including cancellation. Due to a bug in the retrieveSubscriptions() method that cancels subscriptions instead of merely retrieving them, any authenticated user can cancel arbitrary Stripe subscriptions by providing a subscription ID.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/8ac79b9375872f02f72999157b19a40c17126513
github.com/WWBN/AVideo/security/advisories/GHSA-38rh-4v39-vfxv
github.com/advisories/GHSA-38rh-4v39-vfxv
nvd.nist.gov/vuln/detail/CVE-2026-34737

Code Behaviors & Features

Detect and mitigate CVE-2026-34737 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →