Executive brief
WWBN AVideo is an open-source platform used for hosting and sharing video content. A security flaw in its Bitcoin payment plugin allows unauthorized individuals to view private transaction details, such as user IDs and payment amounts, by querying specific Bitcoin addresses. This could lead to the exposure of customer financial activity and link public blockchain transactions to specific users on the platform.
Technical details
A missing authorization vulnerability (CWE-862) exists in the BlockonomicsYPT plugin's 'check.php' endpoint in WWBN AVideo versions 26.0 and prior. The endpoint was designed as an AJAX helper for the authenticated 'invoice.php' page but fails to implement its own access control checks. An unauthenticated attacker can provide a Bitcoin address via the 'addr' GET parameter to retrieve sensitive JSON data, including the internal User ID, payment value, currency, and transaction ID. While the attack complexity is rated high because an attacker must identify Bitcoin addresses used on the platform, these addresses are often discoverable via public blockchain monitoring. As of the advisory date, no official patch is available, though the plugin is considered deprecated.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-02: advisory: GitHub Security Advisory published by maintainer
- 2026-04-06: disclosed: CVE published to NVD