AVideo CVE-2026-56341

Requires only that the target AVideo instance (≤26.0) be network-reachable and have at least one of the PayPalYPT, AuthorizeNet, or BTCPayments plugins installed and enabled - these are bundled with AVideo and commonly present on monetized deployments. No authentication, no user interaction, no special configuration toggles, and no admin role are required; the list.json.php endpoints are served directly by the PHP application without .htaccess or framework-level auth gating. Exploitation is limited only by whether the operator has installed any payment plugin (instances without payment processing have nothing to leak) and whether the plugin View directories are reachable through the front-end webserver (default configuration exposes them).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N) scoring 8.7 accurately reflects a network-reachable, no-privilege, no-interaction data exposure with high confidentiality impact and no integrity or availability effect - consistent with a pure read-only authorization-bypass exfiltration. EPSS and SSVC scores were not supplied in the input, and the vulnerability is not on CISA KEV, so there is no confirmed mass-exploitation signal yet; however, exploitation is fully automatable (single unauthenticated GET) and the affected data (PayPal tokens, agreement IDs, webhook payloads, BTC records) has direct fraud and account-takeover value, making opportunistic scanning likely once advisories propagate. The vendor advisory (GHSA-wprj-9cvc-5w37) and VulnCheck writeup together effectively serve as exploitation documentation, so defenders should treat this as a near-term priority despite the absence of explicit POC code.

An attacker scans internet-exposed AVideo installations and issues an unauthenticated GET to /plugin/PayPalYPT/View/PayPalYPT_log/list.json.php, receiving a JSON dump of every PayPal transaction including agreement IDs, Express Checkout tokens, and stored API response bodies. The same one-line request is repeated against the AuthorizeNet and BTCPayments list endpoints to harvest webhook payloads and Bitcoin transaction records, which are then used for payment fraud, customer phishing, or correlation with leaked user data. No public exploit identified at time of analysis, but the GHSA advisory publishes the exact vulnerable file paths, making reproduction trivial.