The vulnerability in WWBN AVideo (<= 26.0) involves insufficient verification of data authenticity (CWE-345) in the PayPal IPN v1 handler. The handler fails to deduplicate incoming IPN notifications, enabling replay attacks that can artificially increase wallet balances and renew subscriptions without proper payment. Although newer IPN handlers have addressed this issue by logging and deduplicating transactions, the legacy v1 handler remains referenced and vulnerable. This flaw requires low attack complexity and no user interaction, but the attacker must have limited privileges to trigger the replay. The vulnerability impacts data integrity but does not affect confidentiality or availability.

An attacker can exploit this vulnerability to repeatedly replay a legitimate PayPal IPN notification, resulting in unauthorized inflation of wallet balances and subscription renewals. This compromises the integrity of billing and subscription management within the affected AVideo installations. There is no indication of impact on confidentiality or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the newer IPN handlers (ipnV2.php and webhook.php) properly implement transaction deduplication, administrators should consider migrating billing plans to use these updated handlers instead of the vulnerable v1 handler. Monitor vendor communications for an official fix or update addressing this issue.