CVE-2026-39366: CWE-345: Insufficient Verification of Data Authenticity in WWBN AVideo
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.
AI Analysis
Technical Summary
The vulnerability in WWBN AVideo (<= 26.0) involves insufficient verification of data authenticity (CWE-345) in the PayPal IPN v1 handler. The handler lacks transaction deduplication, enabling replay attacks of valid IPN notifications to inflate wallet balances and renew subscriptions fraudulently. Although newer IPN handlers have addressed this by logging and deduplicating transactions, the legacy v1 handler remains referenced and vulnerable. No official patch or remediation level has been published yet.
Potential Impact
An attacker can exploit this vulnerability to repeatedly replay a single valid PayPal IPN notification, causing unauthorized inflation of their wallet balance and unauthorized renewal of subscriptions. This impacts the integrity of billing and subscription management but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using the vulnerable PayPal IPN v1 handler (plugin/PayPalYPT/ipn.php) as the notify_url for billing plans and instead configure the system to use the updated handlers (ipnV2.php or webhook.php) that implement transaction deduplication. Monitor vendor communications for an official fix or update.
CVE-2026-39366: CWE-345: Insufficient Verification of Data Authenticity in WWBN AVideo
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in WWBN AVideo (<= 26.0) involves insufficient verification of data authenticity (CWE-345) in the PayPal IPN v1 handler. The handler lacks transaction deduplication, enabling replay attacks of valid IPN notifications to inflate wallet balances and renew subscriptions fraudulently. Although newer IPN handlers have addressed this by logging and deduplicating transactions, the legacy v1 handler remains referenced and vulnerable. No official patch or remediation level has been published yet.
Potential Impact
An attacker can exploit this vulnerability to repeatedly replay a single valid PayPal IPN notification, causing unauthorized inflation of their wallet balance and unauthorized renewal of subscriptions. This impacts the integrity of billing and subscription management but does not affect confidentiality or availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid using the vulnerable PayPal IPN v1 handler (plugin/PayPalYPT/ipn.php) as the notify_url for billing plans and instead configure the system to use the updated handlers (ipnV2.php or webhook.php) that implement transaction deduplication. Monitor vendor communications for an official fix or update.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-04-06T21:29:17.350Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 69d55f07aaed68159a56294a
Added to database: 4/7/2026, 7:46:15 PM
Last enriched: 4/7/2026, 8:03:05 PM
Last updated: 4/8/2026, 12:42:34 AM
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.