MEDIUM 6.0 NVD
CVE-2026-123486
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6
- https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-pay
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-11-06 via NVD.
vulnfeed aggregates 16326 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.