{"id":"CVE-2026-123486","kind":"vulnerability","aliases":["CVE-2026-123486"],"related":[],"title":"WWBN AVideo: PayPal payment notice race lets replays double-credit wallets","description":"WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.","summary":"WWBN AVideo versions 29.0 through 29.4.0 have a race condition in the PayPal IPN handler (plugin/PayPalYPT/ipn.php) where the duplicate-payment check and the insert are not atomic. An attacker who captures a valid recurring-payment notification can replay it concurrently to receive duplicate wallet credits and subscription renewals.","severity":"medium","cvss":6.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","other","paypal","php","video-platform"],"not_affected_if":["plugin-disabled","version-outside-range"],"how_to_check":"- Check the installed AVideo version; affected range is `29.0` through `29.4.0`.\n- Look for the PayPal plugin at `plugin/PayPalYPT/ipn.php` and confirm whether the PayPalYPT plugin is enabled.","fix":null,"status":"open","published_at":"2026-11-06T15:17:17+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","triaged_at":"2026-11-06T15:44:33+00:00","updated_at":"2026-11-06T15:44:33+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T15:44:33Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WWBN AVideo: PayPal payment notice race lets replays double-credit wallets","impact":"medium","summary":"WWBN AVideo versions 29.0 through 29.4.0 have a race condition in the PayPal IPN handler (plugin/PayPalYPT/ipn.php) where the duplicate-payment check and the insert are not atomic. An attacker who captures a valid recurring-payment notification can replay it concurrently to receive duplicate wallet credits and subscription renewals.","audience":"businesses","category":"other","nicknames":[],"who_cares":["avideo","php","paypal","video-platform"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"attacker gains duplicate wallet credits and subscription renewals","analyst_note":"Confirm the fixed version and whether replay requires any prior access; see the NVD entry and the linked vendor advisory on github.com.","how_to_check":"- Check the installed AVideo version; affected range is `29.0` through `29.4.0`.\n- Look for the PayPal plugin at `plugin/PayPalYPT/ipn.php` and confirm whether the PayPalYPT plugin is enabled.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-disabled","version-outside-range"],"who_is_affected":"Sites running WWBN AVideo 29.0 through 29.4.0 with the PayPalYPT plugin handling recurring PayPal IPN notifications. Sites without that plugin or outside the version range are not indicated as affected. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000738,"input_tokens":4332,"output_tokens":609,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123486':15A,18A '-2026':14A,17A '29.0':29B,78C '29.4.0':31B,80C 'allow':89C 'atom':53B,101C 'attack':55B,90C,106C 'avideo':2A,19B,27B,77C 'bypass':92C 'captur':57B,111C 'check':47B,103C 'concurr':67B,108C 'condit':35B,84C 'contain':81C 'credit':11A,72B,125C 'cve':13A,16A 'dedupl':102C 'doubl':10A 'double-credit':9A 'due':96C 'duplic':45B,70B,123C 'duplicate-pay':44B 'handler':40B 'insert':50B,105C 'ipn':39B,93C 'isrecurringpaymentidus':121C 'let':7A 'non':100C 'non-atom':99C 'notic':5A 'notif':63B,116C 'obtain':122C 'pass':120C 'payment':4A,46B,62B,115C 'paypal':3A,21B,38B 'php':22B 'platform':25B 'plugin/paypalypt/ipn.php':41B,87C 'protect':95C 'race':6A,34B,83C 'receiv':69B 'recur':61B,114C 'recurring-pay':60B,113C 'renew':75B,128C 'replay':8A,65B,94C,109C 'request':119C 'subscript':74B,127C 'valid':59B,112C 'version':28B 'video':24B 'video-platform':23B 'vulner':85C 'wallet':12A,71B,124C 'wwbn':1A,26B,76C","nicknames":[],"mitigations":[],"who_affected":"Sites running WWBN AVideo 29.0 through 29.4.0 with the PayPalYPT plugin handling recurring PayPal IPN notifications. Sites without that plugin or outside the version range are not indicated as affected. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["avideo","medium","other","paypal","php","videoplatform"],"campaign_type":null,"search_a":"'-123486':15A,18A '-2026':14A,17A 'avideo':2A 'credit':11A 'cve':13A,16A 'doubl':10A 'double-credit':9A 'let':7A 'notic':5A 'payment':4A 'paypal':3A 'race':6A 'replay':8A 'wallet':12A 'wwbn':1A","search_b":"'29.0':29B '29.4.0':31B 'atom':53B 'attack':55B 'avideo':19B,27B 'captur':57B 'check':47B 'concurr':67B 'condit':35B 'credit':72B 'duplic':45B,70B 'duplicate-pay':44B 'handler':40B 'insert':50B 'ipn':39B 'notif':63B 'payment':46B,62B 'paypal':21B,38B 'php':22B 'platform':25B 'plugin/paypalypt/ipn.php':41B 'race':34B 'receiv':69B 'recur':61B 'recurring-pay':60B 'renew':75B 'replay':65B 'subscript':74B 'valid':59B 'version':28B 'video':24B 'video-platform':23B 'wallet':71B 'wwbn':26B","search_c":"'29.0':78C '29.4.0':80C 'allow':89C 'atom':101C 'attack':90C,106C 'avideo':77C 'bypass':92C 'captur':111C 'check':103C 'concurr':108C 'condit':84C 'contain':81C 'credit':125C 'dedupl':102C 'due':96C 'duplic':123C 'insert':105C 'ipn':93C 'isrecurringpaymentidus':121C 'non':100C 'non-atom':99C 'notif':116C 'obtain':122C 'pass':120C 'payment':115C 'plugin/paypalypt/ipn.php':87C 'protect':95C 'race':83C 'recur':114C 'recurring-pay':113C 'renew':128C 'replay':94C,109C 'request':119C 'subscript':127C 'valid':112C 'vulner':85C 'wallet':124C 'wwbn':76C","first_public_at":"2026-10-22T23:52:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123486","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123486","severity":null,"published_at":"2026-11-06T15:17:17+00:00","modified_at":"2026-11-06T15:17:17+00:00","first_seen_at":"2026-11-06T15:42:43+00:00","fetched_at":"2026-11-06T15:42:43+00:00","note":null}],"documents":[{"id":87552,"url":"https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-22T23:52:07+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":87553,"url":"https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-paypal-ipn-deduplication-via-ipn-php","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}