Which versions of AVideo are affected by CVE-2026-56341?

AVideo versions through 26.0 expose payment transaction records and authentication credentials across PayPal, Authorize.Net, and Bitcoin payment plugins to unauthenticated remote attackers.

How to fix or mitigate CVE-2026-56341?

Within 24 hours: Identify all AVideo deployments running version 26.0 or earlier with affected payment plugins; restrict network access to list.json.php endpoints in PayPalYPT, AuthorizeNet, and BTCPayments directories. Within 7 days: Deploy WAF rules blocking external access to plugin payment endpoints; rotate all payment API credentials and tokens. Within 30 days: Monitor vendor advisories for patched versions; prepare contingency plan for alternate payment processor if patch remains unavailable beyond 30 days.

AVideo CVE-2026-56341

Q: What is the CVSS score of CVE-2026-56341?

CVE-2026-56341 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38130 HIGH

Missing Authorization (CWE-862)

2026-06-20 VulnCheck

Authentication Bypass PHP Avideo

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Unauthenticated HTTP GET against default plugin endpoints yields full payment-log disclosure: AV:N/AC:L/PR:N/UI:N with C:H only - no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 05:54 vuln.today

Analysis Generated

Jun 22, 2026 - 05:54 vuln.today

DescriptionCVE.org

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

AnalysisAI

Unauthenticated information disclosure in AVideo through 26.0 exposes payment transaction records via multiple list.json.php endpoints in the PayPalYPT, AuthorizeNet, and BTCPayments plugins that lack User::isAdmin() authorization checks. Remote attackers can issue direct GET requests to harvest PayPal billing agreement IDs, Express Checkout tokens, Authorize.Net webhook payloads, and Bitcoin transaction records without credentials. No public exploit identified at time of analysis, but the GHSA advisory from WWBN/AVideo and VulnCheck disclosure provide full endpoint paths sufficient for trivial reproduction.

Technical ContextAI

AVideo is an open-source video streaming platform (cpe:2.3:a:avideo:avideo) whose ObjectYPT admin CRUD pattern auto-generates four endpoints per database table (add, delete, list, index). The root cause is CWE-862 Missing Authorization: while add.json.php and delete.json.php correctly invoke User::isAdmin(), the parallel list.json.php files only include configuration.php, which bootstraps the framework without enforcing authentication. The same vulnerability class was previously patched for the Scheduler plugin in commit 83390ab1f (GHSA-j724-5c6c-68g5), but the remediation was never propagated to the 21 remaining payment-related list endpoints, leaving getAll() invocations against PayPalYPT_log, Anet_webhook_log, and Btc_payments tables exposed to anonymous HTTP callers.

RemediationAI

Upstream fix available (commit 1729a955f8de7e26552eb728b3d1e6f4b1b9352e); released patched version not independently confirmed, so operators tracking tagged releases should monitor https://github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37 and upgrade beyond 26.0 once a fixed tag ships. As an immediate compensating control, add a webserver rule (Apache .htaccess or Nginx location block) denying anonymous access to plugin/PayPalYPT/View/PayPalYPT_log/list.json.php, plugin/AuthorizeNet/View/Anet_webhook_log/list.json.php, plugin/BTCPayments/View/Btc_payments/list.json.php and the other 18 sibling list.json.php endpoints under plugin/*/View/*/, or restrict /plugin/*/View/ to admin source IPs - this will break the admin DataTables UI for those plugins until patched. Operators should also rotate any exposed PayPal API tokens and Authorize.Net webhook secrets and audit access logs for prior GET requests to these paths since the endpoints have existed unauthenticated for an unknown duration.