Avideo EUVD-2026-19878

CVSS 6.5 and network-accessible attack vector (AV:N) indicate moderate-to-high severity. However, the attack requires authenticated access (PR:L), meaning only legitimate subscription holders can exploit this-not external threat actors. The lack of confidentiality impact (C:N) but high integrity impact (I:H) shows that attackers defraud the system via balance manipulation rather than stealing data. EPSS or exploitation probability data is not provided, but the vulnerability's reliance on a well-known attack pattern (IPN replay) and documented deduplication fix suggests moderate real-world exploitation likelihood. The fact that newer handlers implement correct deduplication implies this is a known attack class. Practical risk depends on PayPal IPN processing volume and whether the platform monetizes account credits; high-activity platforms face greater financial exposure. From an SSVC perspective, exploitation is likely (authenticated replay is automatable), technical impact is moderate (wallet manipulation, subscription renewal), and automatable attackers (bots replaying captured IPN messages) can execute this at scale.

An authenticated user with an active AVideo subscription captures a legitimate PayPal IPN notification message (e.g., subscription renewal or credit purchase) by monitoring network traffic or obtaining it via a compromised payment account. The attacker then replays this IPN message to the v1 handler multiple times-either programmatically or via repeated HTTP requests-causing the platform to credit their wallet or extend their subscription repeatedly without processing new transactions. With low attack complexity and network accessibility, an automated script could continuously replay captured IPN messages within seconds, inflating the attacker's account balance or maintaining indefinite access to premium features. No public exploit code is referenced in available data, but the attack requires only basic HTTP replay capability, making it trivial for any authenticated user to execute.