# CVE-2026-123486: WWBN AVideo race condition in PayPal IPN deduplication

Source: https://junglewise.ai/threats/cve-2026-123486-wwbn-avideo-29-0-through-29-4-0-contains-a-race-condition  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-123486 · Severity: medium · CVSS 5.3 · Published 2026-11-06

AVideo is a video hosting and streaming platform that processes payments through PayPal. A race condition in the PayPal notification handler allows attackers to replay payment notifications concurrently to bypass fraud checks, resulting in duplicate wallet credits and unauthorized subscription renewals without paying twice. This directly enables financial loss and unauthorized access to paid content.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-123486 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-123486 being exploited in the wild.

**How severe is CVE-2026-123486?** Medium severity, with a CVSS score of 5.3, published 6 November 2026.

**Which products and versions are affected?** WWBN AVideo 29.0 through 29.4.0.

**Is there a fix for CVE-2026-123486?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-123486 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-123486?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a time-of-check-time-of-use (TOCTOU) race condition in plugin/PayPalYPT/ipn.php where isRecurringPaymentIdUsed() is called to check if a payment has been processed, but the deduplication check and database insert are not atomic. An attacker with network access can send two concurrent copies of a captured valid recurring-payment IPN notification; both will pass the check before either records the transaction, allowing both to execute wallet credit and subscription renewal operations. The table schema lacks a unique constraint on recurring_payment_id, permitting duplicate entries.

## Affected products

- WWBN AVideo 29.0 through 29.4.0

## Timeline

- 2026-10-22: disclosed: GitHub Security Advisory published
- 2026-11-06: advisory: CVE-2026-123486 published

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6](https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6)
- [https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-paypal-ipn-deduplication-via-ipn-php](https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-paypal-ipn-deduplication-via-ipn-php)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)