CVE-2026-33731
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
In WWBN AVideo prior to version 29.0, a vulnerability in the Authorize.Net webhook handler allows an attacker to bypass signature verification and forge webhook requests with arbitrary payment amounts and target user IDs. The attacker can credit arbitrary wallet balances to any user without a corresponding payment and activate premium subscriptions, leading to free access to paid content and direct revenue loss.
Risk Assessment
The organization faces direct financial losses due to the ability to credit user wallets without actual payments and provide free access to paid content. This can also compromise the integrity of the payment system and user trust.
Recommendation
Immediately update WWBN AVideo to version 29.0 or later, which includes a fix for this vulnerability. Before updating, consider temporarily disabling or restricting access to the Authorize.Net webhook endpoint.
Other vulnerabilities in WWBN AVideo
See all- CVE-2026-43885High
WWBN AVideo is an open source video platform that, in versions up to 29.0, allows unauthenticated users to read APISecret from objects/plugins.json.php. This enables them to call protected API endpoints, such as users_list, without logging in.
- CVE-2026-55173High
WWBN AVideo versions 29.0 and below are vulnerable to OS command injection. The fix for CVE-2026-33482 was incomplete and does not neutralize a single & (shell background operator), allowing multiple commands to be chained.
- CVE-2026-33684Medium
A privilege escalation vulnerability in WWBN AVideo prior to version 29.0 allows any user who can solve a CAPTCHA to self-grant elevated permissions during registration via unguarded API parameters. Attackers can mark accounts as email-verified and obtain upload, streaming, and meeting creation rights.
- CVE-2026-47696Medium
In WWBN AVideo version 29.0 and earlier, the endpoint plugin/AuthorizeNet/processPayment.json.php credits the user's wallet based solely on the attacker-controlled amount parameter, without validating any Authorize.Net transaction. This allows any logged-in user to add arbitrary funds to their AVideo wallet.
- CVE-2026-47694Medium
WWBN AVideo in version 29.0 and earlier stores category descriptions from user input and renders them as raw HTML in the Gallery view. A user who can create or edit categories can store JavaScript in a category description, which executes when another user views the affected page. This is a stored XSS vulnerability in the category description field.
- CVE-2026-46337Medium
WWBN AVideo is an open source video platform. In 29.0 and earlier, an unauthenticated remote attacker can read arbitrary image files anywhere on disk that the PHP user can open — including private user-profile photos that the application's normal serving wrappers gate behind ACLs, admin-uploaded thumbnails, encrypted-video poster frames, and image content under sibling-app directories reachable via .. traversal. The endpoint requires no authentication.
- CVE-2026-45731Medium
In WWBN AVideo (version 29.0 and earlier), view/update.php reads $_POST['updateFile'] as a relative path under updatedb/ and passes it to PHP's file() for line-by-line execution as part of a database migration. An authenticated administrator can abuse this to read arbitrary text files reachable from the web-server process.
- CVE-2026-45620Medium
In WWBN AVideo 29.0 and earlier, the file objects/mention.json.php lacks authentication checks or an admin gate. It only has a simple entry guard: preg_match('/^@/', $_REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated user enumeration.
- CVE-2026-45619Medium
WWBN AVideo in version 29.0 and earlier does not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE in EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations. This opens a DNS-rebinding TOCTOU vulnerability.
- CVE-2026-45610Medium
WWBN AVideo version 29.0 and earlier contains a cross-site request forgery (CSRF) vulnerability in the 2FA toggle. An attacker can use a hidden form or fetch request without credentials to disable the victim's 2FA with a single POST request.
Original NVD description (English source)
WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying a valid transaction ID from a small legitimate purchase, the attacker bypasses signature validation and credits arbitrary wallet balances to any user account via attacker-controlled payload fields. Three flaws combine into an exploit chain: signature bypass via OR logic (webhook.php:33), payload values override API-fetched values (AuthorizeNet.php:169-171, webhook.php:44-48) and a missing approval check (webhook.php:61-75). By forging payment metadata, an attacker can credit arbitrary amounts to any user's wallet without a corresponding payment and include a plans_id to activate premium subscriptions (webhook.php:86-134), enabling free access to all paid and premium content and causing direct revenue loss to the platform owner. This issue has been fixed in version 29.0.