CVE-2026-39366

MediumCVSS 6.5

Published: 07/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

WWBN AVideo versions 26.0 and prior have a vulnerability in the PayPal IPN v1 handler that lacks transaction deduplication. An attacker can replay a single IPN notification to repeatedly inflate wallet balance and renew subscriptions.

Risk Assessment

Reusing the same transaction multiple times leads to unauthorized enrichment and compromises the financial integrity of the platform.

Recommendation

Update AVideo to the latest version that includes the fixed IPN handler.

Original NVD description (English source)

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.