CVE-2026-126543

WWBN AVideo versions up to and including 29.7.1 are vulnerable to an improper payment verification vulnerability in the plugin/PayPalYPT/ipnV2.php component. The flaw allows unauthenticated attackers to credit wallets by forwarding genuine VERIFIED recurring-payment IPNs from their own PayPal acc...

CVE-2026-126543 WWBN AVideo through 29.7.1 Wallet Credit Manipulation via PayPalYPT ipnV2.php

WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that credits wallets from PayPal IPNs not bound to the site's merchant account. Unauthenticated attackers can forward genuine VERIFIED recurring-payment IPNs from their own PayPal...

CVE-2026-89251 AVideo Missing Authorization via AD_Server log.php Wallet Credit

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

EUVD-2026-76063

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/ADServer/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests...

CVE-2026-89251

AVideo (through commit c3edcc274c389816d434acadac07ee78eaf330c1) contains a missing authorization flaw in plugin/AD_Server/log.php. The plugin fails to validate ad impressions, allowing any logged-in user to submit arbitrary label values that trigger unverified YPTWallet credits to campaign video...

CVE-2026-33731: Insufficient Verification of Data Authenticity

WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying...

PT-2026-51434

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0 Description The Authorize.Net webhook handler at 'plugin/AuthorizeNet/webhook.php' contains a signature verification bypass. An attacker can forge webhook requests by providing a valid transaction ID from a small...

WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

PT-2026-46853

Summary plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance without...

CVE-2026-47696 WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess =...