Executive brief
WWBN AVideo is an open-source platform used for hosting and managing video content. A flaw in its PayPal payment processing system allows users to reuse a single successful payment notification multiple times. By replaying these notifications, an attacker can artificially inflate their account balance or renew subscriptions indefinitely without actually paying, leading to direct financial loss for the platform operator.
Technical details
The PayPal IPN v1 handler located at 'plugin/PayPalYPT/ipn.php' lacks transaction deduplication logic. While the handler verifies the authenticity of the Instant Payment Notification (IPN) via PayPal's validation endpoint, it does not check if the specific transaction ID (txn_id) or verification signature (verify_sign) has been processed previously. An attacker with a valid account and one legitimate transaction can capture the IPN POST body and replay it to the server. Each replay triggers the 'addBalance' and 'Subscription::renew' functions, as the 'ipn.php' script remains the active 'notify_url' for billing plans despite newer handlers (ipnV2.php) having implemented proper logging and deduplication. A patch has been released to add deduplication checks to the v1 handler.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE-2026-39366 published
- 2026-04-07: patched: Fix committed to repository