PT-2026-30985 · Wwbn · Avideo

Published 2026-04-07 · Updated 2026-04-07 · CVE-2026-39366

NVD

CVSS v3.1

6.5

Medium

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT log entries, but the v1 handler was never updated and remains actively referenced as the notify url for billing plans.

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2026-39366

Affected Products

Avideo

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2026-39366 · Security Note
• https://github.com/WWBN/AVideo/commit/8f53e9d9c6aaa07d51ace30691981edbbfb5ca1c · Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-mmw7-wq3c-wf9p · Note