CVE-2026-47696 Details
Description
WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.
A vulnerability in WWBN AVideo versions through 29.0 in the AuthorizeNet payment processing endpoint allows logged-in users to manipulate their wallet balance. The endpoint improperly credits the user's wallet based solely on the amount specified in the POST request, without validating any actual Authorize.Net transaction or payment details. This flaw enables users to add arbitrary funds to their AVideo wallet when the AuthorizeNet and YPTWallet plugins are active.
It is recommended to remove or disable the 'processPayment.json.php' file if it is no longer needed. Wallet credits should not be based solely on client-supplied amounts. Instead, utilize the Authorize.Net transaction verification process to ensure payments are legitimate before updating wallet balances. Adding regression tests to prevent similar vulnerabilities in the future is also advised.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-9392-pj54-qqf8 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-9392-pj54-qqf8 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-345 | Insufficient Verification of Data Authenticity | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 1, 2026 | Initial Analysis | [email protected] |
| May 29, 2026 | CVE Modified | CISA-ADP |
| May 29, 2026 | New CVE Received | [email protected] |