Vulnerability Description
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37
- https://www.vulncheck.com/advisories/avideo-unauthenticated-access-to-payment-lo
- https://github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37
FAQ
What is CVE-2026-56341?
CVE-2026-56341 is a vulnerability with a CVSS score of 7.5 (HIGH). AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin trans...
How severe is CVE-2026-56341?
CVE-2026-56341 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56341?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.