Executive brief
WWBN AVideo is an open-source video sharing platform. A vulnerability in its payment processing system allows users to bypass security checks when using the Authorize.Net payment gateway. By manipulating payment notifications, an attacker can falsely credit their account with any amount of money or activate premium subscriptions without actually paying. This results in direct financial loss for the platform owner and unauthorized access to paid content.
Technical details
The Authorize.Net webhook handler in `plugin/AuthorizeNet/webhook.php` contains a logic error in its signature validation. Specifically, an 'OR' condition allows execution to continue if a valid transaction ID is provided, even if the cryptographic signature is missing or invalid. By using a transaction ID from a legitimate small purchase, an attacker can submit a forged JSON payload where the 'amount' and 'users_id' fields override the actual transaction data fetched from the API. Furthermore, the application fails to verify the 'isApproved' status before calling `processSinglePayment()`. This exploit chain allows a low-privileged user to credit arbitrary funds to any account or activate premium plans by including a 'plans_id' in the forged metadata. The issue is fixed in version 29.0.
Affected products
- WWBN AVideo < 29.0
Timeline
- 2026-03-23: patched: Fix committed to repository
- 2026-06-22: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD