CVE-2026-33731 affects WWBN AVideo's Authorize.Net webhook handler in versions before 29.0. The vulnerability is due to insufficient verification of data authenticity (CWE-345), where an attacker can bypass signature validation by exploiting OR logic in the webhook signature check. By supplying a valid transaction ID from a small legitimate purchase, the attacker can override payload values that normally come from the API and bypass approval checks. This allows arbitrary wallet credits to any user and activation of premium subscriptions without actual payments, causing direct revenue loss. The issue is fixed in version 29.0.

An attacker can forge payment webhook requests to credit arbitrary amounts to any user's wallet and activate premium subscriptions without corresponding payments. This leads to unauthorized access to paid content and direct financial loss to the platform owner. There is no impact on confidentiality or availability reported.

A fix is available in WWBN AVideo version 29.0. Users should upgrade to version 29.0 or later to remediate this vulnerability. Since this is a cloud service, the vendor manages remediation for the hosted service; users should verify with the vendor that the service is updated. No additional mitigation steps are indicated.