CVE-2026-33731 affects WWBN AVideo's Authorize.Net webhook handler in versions before 29.0. The vulnerability is due to insufficient verification of data authenticity (CWE-345), specifically a signature verification bypass via OR logic in webhook.php, allowing attackers to forge webhook requests. Attackers can supply a valid transaction ID from a small legitimate purchase to bypass signature validation, then override payload values to credit arbitrary wallet balances and activate premium subscriptions without actual payment. The exploit chain involves three flaws: signature bypass, payload overriding API-fetched values, and missing approval checks. This results in unauthorized crediting of user wallets and activation of premium content access, causing direct financial loss to the platform owner. The issue has been fixed in version 29.0.

An attacker with limited privileges can forge webhook requests to credit arbitrary amounts to any user's wallet and activate premium subscriptions without payment. This leads to unauthorized access to paid content and direct revenue loss for the platform owner. There is no impact on confidentiality or availability reported. The CVSS score is 6.5 (medium severity) with impact primarily on integrity.

A patch is available and the issue is fixed in WWBN AVideo version 29.0. Since this is a cloud service, the vendor manages remediation server-side. Users should verify with the vendor advisory that their instance is updated to version 29.0 or later to ensure the vulnerability is mitigated.