CVE-2026-56341: AVideo Unauthenticated Payment Data Exposure (v26.0 and earlier)

Technical summary

CVE-2026-56341 identifies insufficient authorization controls in AVideo's payment plugin architecture. Multiple list.json.php endpoints across PayPal, Authorize.Net, and Bitcoin payment integrations fail to implement authentication or authorization checks before returning sensitive transaction objects. An unauthenticated attacker can enumerate and retrieve payment data via GET requests to these endpoints, obtaining agreement IDs, user financial records, raw API responses, and cryptographic tokens. The vulnerability is rooted in CWE-862 (Missing Authorization), a foundational access control defect. The network-accessible, low-complexity attack vector (CVSS 3.1 score 7.5/HIGH) means exploitation requires no user interaction and can be performed by any internet-connected actor.

Business impact

Organizations running AVideo are exposed to wholesale disclosure of payment transaction history and user financial records. Compromised PayPal and Authorize.Net credentials could enable unauthorized refunds, chargebacks, or fraudulent transactions. Exposed API tokens grant attackers persistent access to payment gateway accounts even after the AVideo instance is patched. User trust is damaged; depending on jurisdiction and user base size, notification and potential regulatory disclosure (PCI DSS, GDPR) obligations may apply. Bitcoin transaction records expose user financial behavior and can facilitate money laundering or targeted fraud.

Affected systems

AVideo versions up to and including 26.0 are affected. All deployments using payment plugins (PayPal, Authorize.Net, Bitcoin) are at risk. Cloud-hosted, on-premise, and self-hosted instances are equally vulnerable if they have not been patched. Organizations should immediately audit their AVideo version via the admin dashboard and check deployment notes for any patch history.

Exploitability

Exploitability is high and requires minimal attacker sophistication. No authentication credentials are needed; no user interaction is required. An attacker with network access can send unauthenticated GET requests to predictable endpoint paths (list.json.php) and immediately retrieve structured payment data. Scanning for vulnerable instances is straightforward using public internet search engines or network reconnaissance. There is no indication this vulnerability is currently exploited in the wild (KEV status is false), but the low barrier to exploitation and high sensitivity of exposed data create significant risk of imminent abuse.

Remediation

Upgrade AVideo to a patched version that implements proper authorization checks on all payment plugin endpoints. Verify the upgrade with the vendor advisory to confirm the specific version that addresses this issue. After patching, audit logs to identify whether the vulnerable endpoints were accessed. Immediately rotate all exposed API credentials (PayPal tokens, Authorize.Net keys, Bitcoin wallet keys) through their respective vendor consoles. Review transaction histories for unauthorized activity. For organizations unable to patch immediately, disable payment plugins at the application level and implement network-level access controls (firewall rules) to prevent direct requests to /list.json.php endpoints.

Patch guidance

Check the official AVideo project repository and vendor advisory for the first patched version released after 26.0. Apply the patch in a staging environment first, testing payment functionality end-to-end. Verify that list.json.php endpoints now return 403 or 401 responses for unauthenticated requests. Document the patch version applied and the date applied for compliance records. Schedule the production deployment during a maintenance window to minimize disruption.

Detection guidance

Log and analyze HTTP requests to payment plugin directories, particularly any GET requests to */list.json.php endpoints from external or untrusted sources. Monitor for 200 OK responses containing payment_token, api_key, or webhook_url fields in responses. Review web server access logs for patterns of repeated requests to these endpoints from single IPs—a signature of automated scanning. Implement request filtering to deny unauthenticated access to payment plugin directories at the web application firewall (WAF) level. Use vulnerability scanners configured to test authorization on JSON endpoints to catch similar misconfigurations.

Why prioritize this

This vulnerability merits immediate attention because it enables complete, unauthenticated disclosure of financial records and API credentials with no exploitation complexity. The high CVSS score (7.5) reflects the severity of confidentiality impact. Organizations that process payments through AVideo face direct financial and legal liability if user data or payment credentials are stolen. The ease of exploitation and the lack of any authentication barrier make this a top candidate for both opportunistic and targeted attacks. Even though KEV status is currently false, the simplicity and impact suggest rapid weaponization is likely.

Risk score, explained

CVSS 3.1 score of 7.5/HIGH is driven by: (1) Network-accessible attack vector requiring no user proximity; (2) Low attack complexity—no special conditions or tools needed; (3) No privilege or authentication requirements; (4) High confidentiality impact—all payment and user financial records exposed; (5) No integrity or availability impact—read-only disclosure. The score does not account for business context (financial liability, regulatory exposure, credential compromise leading to lateral attack), which may elevate organizational risk beyond the numeric score.

Frequently asked questions