Executive brief
AVideo is a video streaming and management platform that includes payment processing plugins. Multiple administrative data export endpoints in the plugin system lack authentication checks, allowing any unauthenticated user to download complete records of financial transactions, payment tokens, and sensitive system logs. This exposes PayPal agreement IDs, cryptocurrency transaction records, user payment history, and infrastructure details.
Technical details
The vulnerability exists in AVideo's ObjectYPT admin CRUD pattern, which generates four endpoints per database table: add.json.php, delete.json.php, list.json.php, and index.php. The add.json.php and delete.json.php endpoints correctly implement User::isAdmin() authorization checks, but list.json.php endpoints have no authorization gate whatsoever. Affected endpoints include PayPalYPT_log/list.json.php, Anet_webhook_log/list.json.php, Btc_payments/list.json.php, and 18 others across payment, streaming, meeting, and analytics plugins. Each endpoint directly calls ObjectYPT::getAll() to return a JSON-encoded SELECT * result set containing all table records. The configuration.php bootstrap performs no global authentication gating, and no .htaccess rules restrict plugin View directory access. An unauthenticated attacker needs only a network path and a single HTTP GET request to dump entire database tables containing PayPal billing agreement IDs, Express Checkout tokens, transaction amounts, user IDs, full API payloads, Bitcoin identifiers, and live streaming infrastructure details. This is the same vulnerability class fixed in commit 83390ab1f for the Scheduler plugin (GHSA-j724-5c6c-68g5), but the patch was not applied to the remaining 21 endpoints.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-03-27: disclosed
- 2026-03-29: advisory