Executive Summary

CVE-2026-56341 is a vulnerability in AVideo versions up to 26.0 where multiple payment plugin endpoints named list.json.php lack proper authorization checks.

Because these endpoints do not verify if a user is authorized or an admin, unauthenticated attackers can access sensitive payment data.

This includes PayPal tokens, Authorize.Net webhook payloads, Bitcoin transaction records, agreement IDs, user financial records, and API responses.

Attackers can retrieve this data simply by sending direct GET requests to these vulnerable endpoints.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a significant confidentiality breach of sensitive financial and user data.

• Exposure of PayPal tokens and Bitcoin transaction records.
• Unauthorized access to Authorize.Net webhook payloads.
• Disclosure of agreement IDs and user financial records.

Such exposure can result in financial fraud, identity theft, and loss of trust from users or customers.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by attempting unauthenticated GET requests to the vulnerable list.json.php endpoints in the payment plugins of AVideo versions up to 26.0. If these endpoints return sensitive payment transaction data without requiring authentication, the system is vulnerable.

You can use commands like curl to test these endpoints. For example:

• curl -X GET http://<your-avideo-domain>/plugin/paymentPluginName/list.json.php
• Replace <your-avideo-domain> with your server's domain and paymentPluginName with the specific payment plugin folder name.

If the response contains payment transaction data such as PayPal tokens, Authorize.Net webhook payloads, or Bitcoin transaction records without authentication, the vulnerability is present.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation involves restricting access to the vulnerable list.json.php endpoints by enforcing proper authorization checks.

Specifically, add authentication and authorization checks such as User::isAdmin() to all list.json.php endpoints in the payment plugins, similar to the controls already present in add.json.php and delete.json.php endpoints.

Additionally, consider temporarily disabling or restricting access to these endpoints at the web server or firewall level until a proper patch or update is applied.

Finally, update AVideo to a version later than 26.0 once a patch addressing this vulnerability is released.

Useful 0 Not Useful 0