Is CVE-2026-56341 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56341 being exploited in the wild.

How severe is CVE-2026-56341?

High severity, with a CVSS score of 7.5, published 20 June 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) <= 26.0, ECOSYSTEM:introduced=0,last_affected=26.0; WWBN AVideo <= 26.0.

Is there a fix for CVE-2026-56341?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56341 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56341?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56341: AVideo missing authorization in multiple plugin list endpoints

Q: Is there a fix for CVE-2026-56341?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-56341 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-56341?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56341 · Severity: high · CVSS 7.5 · Published 2026-06-20

AVideo is a video streaming and management platform that includes payment processing plugins. Multiple administrative data export endpoints in the plugin system lack authentication checks, allowing any unauthenticated user to download complete records of financial transactions, payment tokens, and sensitive system logs. This exposes PayPal agreement IDs, cryptocurrency transaction records, user payment history, and infrastructure details.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-56341 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56341 being exploited in the wild.
How severe is CVE-2026-56341?: High severity, with a CVSS score of 7.5, published 20 June 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) <= 26.0, ECOSYSTEM:introduced=0,last_affected=26.0; WWBN AVideo <= 26.0.
Is there a fix for CVE-2026-56341?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56341 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56341?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in AVideo's ObjectYPT admin CRUD pattern, which generates four endpoints per database table: add.json.php, delete.json.php, list.json.php, and index.php. The add.json.php and delete.json.php endpoints correctly implement User::isAdmin() authorization checks, but list.json.php endpoints have no authorization gate whatsoever. Affected endpoints include PayPalYPT_log/list.json.php, Anet_webhook_log/list.json.php, Btc_payments/list.json.php, and 18 others across payment, streaming, meeting, and analytics plugins. Each endpoint directly calls ObjectYPT::getAll() to return a JSON-encoded SELECT * result set containing all table records. The configuration.php bootstrap performs no global authentication gating, and no .htaccess rules restrict plugin View directory access. An unauthenticated attacker needs only a network path and a single HTTP GET request to dump entire database tables containing PayPal billing agreement IDs, Express Checkout tokens, transaction amounts, user IDs, full API payloads, Bitcoin identifiers, and live streaming infrastructure details. This is the same vulnerability class fixed in commit 83390ab1f for the Scheduler plugin (GHSA-j724-5c6c-68g5), but the patch was not applied to the remaining 21 endpoints.

Affected products

WWBN AVideo <= 26.0

Identifiers

CVE-2026-56341
GHSA-wprj-9cvc-5w37

Timeline

2026-03-27: disclosed
2026-03-29: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.