Executive brief
A vulnerability in the AVideo platform's PayPal plugin allows any logged-in user to cancel other people's recurring subscriptions. By providing a specific subscription ID, an attacker can stop payments for other customers, leading to revenue loss for the site owner and a loss of service for the affected users. This occurs because the system fails to verify if the person requesting the cancellation actually owns the subscription.
Technical details
An Insecure Direct Object Reference (IDOR) exists in the `plugin/PayPalYPT/agreementCancel.json.php` endpoint of the AVideo PayPalYPT plugin. While a similar endpoint (`PayPalAgreementCancel.json.php`) correctly implements ownership verification, this specific endpoint only checks if a user is logged in before calling `PayPalYPT::cancelAgreement()` with an attacker-controlled `agreement` parameter. An authenticated attacker who obtains a victim's PayPal billing agreement ID (which may leak through logs or emails) can send a POST request to this endpoint to suspend the victim's recurring billing. This results in an unauthorized state change on the PayPal side and subsequent loss of subscription status within AVideo.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-04-27: disclosed: Initial disclosure to vendor
- 2026-05-05: advisory: GitHub Advisory published
- 2026-05-11: advisory: NVD published CVE-2026-43883