CVE-2026-47696
CVE-2026-47696 · WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint
This page contains facts from public vulnerability sources. Check the original advisory before updating.
WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.
CVSS 7.1 · High · EPSS 0.1%
- Published
- Updated
Stack: php
Affected products and versions
avideo
- Versions
- <= 29.0: Affected
No fix published
wwbn/avideo Packagist
- Affected ranges
- ECOSYSTEM: ≤ 29.0
No fix published