CVE-2026-89251
Received Received - Intake

AVideo Wallet Credit Manipulation via Unverified Ad Impressions

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: VulnCheck

Description
AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-11
Last Modified
2026-09-11
Generated
2026-09-11
AI Q&A
2026-09-11
EPSS Evaluated
N/A
NVD
CVE-2026-89251
EUVD
EUVD-2026-76063

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
avideo avideo *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in AVideo allows logged-in users to exploit the plugin/AD_Server/log.php endpoint by submitting arbitrary label values through POST requests with label=start. This triggers unverified wallet credits to campaign video owners without requiring proof that an ad actually played. The system fails to validate ad impressions, enabling attackers to repeatedly mint YPTWallet balance for any campaign video.

Detection Guidance

Check AVideo server logs for repeated POST requests to plugin/AD_Server/log.php with label=start parameters. Monitor YPTWallet balance changes without corresponding ad play events. Inspect network traffic for suspicious activity targeting the AD_Server endpoint.

Impact Analysis

If you are an AVideo user or administrator, this vulnerability could allow attackers to inflate wallet balances fraudulently, leading to financial losses for campaign video owners. For end users, it may result in unauthorized transactions or manipulated ad metrics. The lack of verification means trust in the system's financial integrity is compromised.

Compliance Impact

This vulnerability could impact compliance with GDPR by enabling unauthorized financial transactions or data manipulation, violating integrity and accountability principles. For HIPAA, if the system handles health-related data, the lack of proper authorization checks may compromise data integrity and security requirements.

Mitigation Strategies

Immediately restrict access to plugin/AD_Server/log.php. Implement server-side validation to verify ad impressions before crediting wallets. Apply input sanitization to prevent arbitrary label values. Consider disabling the YPTWallet feature until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89251. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart