Is CVE-2026-123486 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123486 being exploited in the wild.

How severe is CVE-2026-123486?

Medium severity, with a CVSS score of 5.3, published 6 November 2026.

Which products and versions are affected?

WWBN AVideo 29.0 through 29.4.0.

Is there a fix for CVE-2026-123486?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-123486 attacked?

It is attacked over the network.

Am I affected by CVE-2026-123486?

Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123486: WWBN AVideo race condition in PayPal IPN deduplication

CVE-2026-123486 · Severity: medium · CVSS 5.3 · Published 2026-11-06

AVideo is a video hosting and streaming platform that processes payments through PayPal. A race condition in the PayPal notification handler allows attackers to replay payment notifications concurrently to bypass fraud checks, resulting in duplicate wallet credits and unauthorized subscription renewals without paying twice. This directly enables financial loss and unauthorized access to paid content.

Technologies: WWBN AVideo. Vendors: WWBN.

Quick answers

Is CVE-2026-123486 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123486 being exploited in the wild.
How severe is CVE-2026-123486?: Medium severity, with a CVSS score of 5.3, published 6 November 2026.
Which products and versions are affected?: WWBN AVideo 29.0 through 29.4.0.
Is there a fix for CVE-2026-123486?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-123486 attacked?: It is attacked over the network.
Am I affected by CVE-2026-123486?: Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in plugin/PayPalYPT/ipn.php where isRecurringPaymentIdUsed() is called to check if a payment has been processed, but the deduplication check and database insert are not atomic. An attacker with network access can send two concurrent copies of a captured valid recurring-payment IPN notification; both will pass the check before either records the transaction, allowing both to execute wallet credit and subscription renewal operations. The table schema lacks a unique constraint on recurring_payment_id, permitting duplicate entries.

Affected products

WWBN AVideo 29.0 through 29.4.0

Timeline

2026-10-22: disclosed: GitHub Security Advisory published
2026-11-06: advisory: CVE-2026-123486 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.