CVE-2026-56341 – Unauthenticated Payment Data Exposure – AVideo through v26.0

Summary

CVE-2026-56341 is a high-severity Missing Authorization vulnerability (CWE-862) affecting AVideo (WWBN/AVideo), an open-source self-hosted video streaming platform, through version 26.0. Multiple list.json.php endpoints within AVideo payment plugins contain no authorization checks, enabling any unauthenticated remote attacker to retrieve sensitive payment transaction records — including PayPal tokens, Authorize.Net webhook payloads, and Bitcoin transaction data — via simple HTTP GET requests. The vulnerability carries a CVSS v4.0 score of 8.7 (High) and a CVSS v3.1 score of 7.5 (High).

Technical details

• Root cause: AVideo’s CreatePlugin template for list.json.php endpoints was shipped without any authentication or authorization guard. While the sibling templates add.json.php and delete.json.php correctly enforce User::isAdmin() checks before executing, the list.json.php files across 21 plugin View directories omit this protection entirely. The application bootstrap (configuration.php) performs no global authentication gating, so these endpoints are reachable without a session.
• Trigger conditions: Requires that one or more payment plugins (PayPal, Authorize.Net, or Bitcoin) are installed and configured on the AVideo instance — a non-default but common configuration for operators who accept payments.
• Attack vector: A single unauthenticated HTTP GET request to any vulnerable endpoint (e.g., GET /plugin/PayPalYPT/View/PayPalYPT_log/list.json.php) returns the full contents of the underlying payment log table. No credentials, session token, or user interaction are required.
• Impact: Full unauthenticated read access to payment transaction records, including:
  • PayPal billing agreement IDs and Express Checkout tokens
  • Authorize.Net webhook payloads containing transaction details
  • Bitcoin transaction identifiers and amounts
  • Associated user IDs, payment amounts, and full API response JSON
  • User financial PII and internal system records across 21 exposed endpoints

Affected software

• AVideo (wwbn/avideo): All versions from 0 through 26.0 (inclusive)

Severity

• CVSS v3.1 Base Score: 7.5 (High)
• CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• CVSS v4.0 Score: 8.7 (High)
• CVSS v4.0 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
• CWE: CWE-862 (Missing Authorization)

Mitigation and recommended actions

• No vendor patch is currently available for AVideo through v26.0. Monitor the WWBN/AVideo GitHub repository and the GitHub Security Advisory (GHSA-wprj-9cvc-5w37) for patch releases.
• Immediate workaround — restrict endpoint access: Configure your web server (Apache/Nginx) to block unauthenticated external access to all list.json.php paths under the plugin/ directory tree. Use IP allowlisting or require HTTP authentication at the server layer for these paths.
• Immediate workaround — code-level fix: Add a User::isAdmin() authorization check immediately after the require/header statements in all 21 vulnerable list.json.php endpoint files, following the same pattern applied in the earlier Scheduler plugin patch.
• Disable unused payment plugins: If PayPal, Authorize.Net, or Bitcoin payment plugins are not actively needed, disable and remove them to eliminate the attack surface.
• Rotate exposed credentials: Any AVideo instance that has been internet-exposed with payment plugins enabled should be treated as potentially compromised. Rotate all PayPal API credentials, Authorize.Net API keys, and Bitcoin payment gateway credentials immediately.

IONIX Status

The IONIX research team is tracking ongoing exploitation attempts and recommends immediate patching. Potentially affected assets are outlined in this post.

References

• CVE-2026-56341 at NIST
• GitHub Security Advisory GHSA-wprj-9cvc-5w37