Executive brief
WWBN AVideo is an open-source video sharing platform. A vulnerability in its Stripe payment plugin allows any logged-in user to cancel the paid subscriptions of other customers. This can lead to lost revenue for the platform owner and service disruptions for paying subscribers.
Technical details
A vulnerability exists in the StripeYPT plugin of WWBN AVideo due to a missing authorization check in the 'test.php' debug endpoint and a logic error in the 'retrieveSubscriptions()' method. The debug endpoint only verifies if a user is logged in rather than checking for administrative privileges. Furthermore, the 'retrieveSubscriptions()' method incorrectly calls the Stripe API's cancel function instead of merely fetching subscription data. An authenticated attacker can send a crafted JSON payload containing a target subscription ID to the debug endpoint, triggering an unintended cancellation of that subscription. As of publication, no official patches are available.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-30: advisory: Vendor advisory published on GitHub
- 2026-03-31: disclosed: CVE-2026-34737 published