Read the docs
TI-2026-85948 Aliases CVE-2026-123486GHSA-8pjw-rf82-7c57

Race condition in WWBN AVideo PayPal IPN replay protection

Priority LOW 26CWE-367Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

WWBN AVideo versions 29.0 through 29.4.0 contain a race condition (CWE-367) in plugin/PayPalYPT/ipn.php. The deduplication check and insert for PayPal IPN notifications are not atomic, which allows an attacker to bypass IPN replay protection. By replaying a captured valid recurring-payment notification concurrently, both requests pass isRecurringPaymentIdUsed(), and the attacker obtains duplicate wallet credits and subscription renewals. The CVSS 4.0 base score is 6.0 (MEDIUM).

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Description from the CNA

WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.

Why it matters now

EPSS 0.0017 6th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
WWBNAVideo29.0 – 29.4.0—No fix listedCNA
  • AVideo VendorWWBN Affected 29.0 – 29.4.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*——WWBN
  • cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* Versions — — ·WWBN

Remediation

The sources list no fixed version for WWBN AVideo.

Written with Claude Haiku 5.5 from the sources below · 2026-11-08

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-123486
  2. 2026-11-06 Alias added: GHSA-8pjw-rf82-7c57
  3. 2026-11-08 Priority changed: MEDIUM → LOW

References

Advisory 1

  • TI-2026-82233 OS command injection in AVideo-Encoder via forged streamer login CVSS 3.1CRITICAL 10.0
  • TI-2026-82232 Unauthenticated PHP code injection in AVideo-Encoder installer CVSS 3.1CRITICAL 10.0
  • TI-2026-29567 Code injection in WWBN AVideo CVSS 3.1CRITICAL 10.0
  • TI-2026-26095 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVSS 3.1CRITICAL 9.4
  • TI-2026-25874 Improper access control in WWBN AVideo CVSS 3.1CRITICAL 10.0
  • TI-2026-25758 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVSS 3.1CRITICAL 9.8
See all 364 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences