CVE-2026-56341: AVideo Information Disclosure Vulnerability

CVE-2026-56341 Overview

CVE-2026-56341 is a missing authorization vulnerability [CWE-862] affecting AVideo through version 26.0. The flaw resides in multiple list.json.php endpoints belonging to payment plugins that fail to enforce authorization checks. Unauthenticated attackers can issue direct HTTP GET requests to these endpoints and retrieve payment transaction data, including PayPal agreement and token identifiers, Authorize.Net webhook payloads, and Bitcoin transaction records. Exposed data includes user financial records and raw API responses from upstream payment providers. The vulnerability impacts confidentiality but does not directly affect integrity or availability of the application.

Critical Impact
Remote, unauthenticated attackers can exfiltrate complete payment transaction logs from AVideo deployments without credentials or user interaction.

Affected Products

AVideo (WWBN/AVideo) through version 26.0
AVideo payment plugins exposing list.json.php endpoints
Deployments handling PayPal, Authorize.Net, or Bitcoin payment processing

Discovery Timeline

2026-06-20 - CVE-2026-56341 published to NVD
2026-06-22 - Last updated in NVD database

Technical Details for CVE-2026-56341

Vulnerability Analysis

The vulnerability is a missing authorization flaw [CWE-862] in AVideo's payment plugin architecture. Several DataTables backend endpoints implemented as list.json.php scripts return payment transaction records but omit the authentication and role checks required for sensitive financial data. The affected endpoints belong to plugins handling PayPal, Authorize.Net, and Bitcoin integrations. Each endpoint returns JSON payloads containing agreement IDs, webhook bodies, transaction hashes, and user-linked financial metadata. Because the endpoints rely on GET requests and lack session validation, any network-reachable client can enumerate the payment log directly.

Root Cause

The root cause is the absence of authorization checks at the entry point of the list.json.php handlers in the payment plugins. The handlers proceed to query payment log tables and serialize the results without verifying that the requester is an authenticated administrator. The vulnerable code paths trust the network boundary instead of enforcing per-endpoint access control on sensitive financial datasets.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker locates an AVideo instance, identifies the payment plugin endpoints exposed under the plugin directory, and issues GET requests to the list.json.php URLs. The server responds with JSON containing the full payment transaction dataset. Attackers can script enumeration across multiple AVideo deployments to harvest financial records at scale.

No verified public exploit code is published for this issue. Refer to the GitHub Security Advisory and the VulnCheck Security Advisory for endpoint specifics.

Detection Methods for CVE-2026-56341

Indicators of Compromise

Unauthenticated GET requests to URLs ending in list.json.php within AVideo payment plugin paths
Large JSON responses containing PayPal agreement IDs, Authorize.Net webhook fields, or Bitcoin transaction hashes returned to clients without an authenticated session
High-volume sequential requests from a single source IP enumerating plugin endpoints

Detection Strategies

Inspect web server access logs for HTTP 200 responses to list.json.php URIs originating from unauthenticated sessions or unknown IP ranges
Deploy Web Application Firewall (WAF) rules that match payment plugin paths and require an authenticated session cookie before forwarding the request
Correlate sudden spikes in JSON response sizes from payment plugin paths with absence of an administrator login event in application logs

Monitoring Recommendations

Forward AVideo web server logs to a centralized logging or SIEM platform and alert on anonymous access to payment plugin endpoints
Monitor outbound bandwidth from the AVideo host for unusual transfer volumes that may indicate bulk data exfiltration
Audit referer and user-agent fields on requests to list.json.php for automated scraping patterns

How to Mitigate CVE-2026-56341

Immediate Actions Required

Restrict network access to the AVideo administrative and plugin directories using IP allow-listing or VPN-only access until a patched release is deployed
Disable any AVideo payment plugins that are not actively in use to remove the vulnerable endpoints from the attack surface
Audit historical web access logs for prior unauthenticated requests to list.json.php and treat any successful responses as potential data exposure events

Patch Information

No fixed version is listed in the NVD entry at the time of publication. Administrators should monitor the GitHub Security Advisory GHSA-wprj-9cvc-5w37 for the upstream fix and apply the vendor patch as soon as it is released.

Workarounds

Add server-level authentication, such as HTTP Basic Auth or a reverse proxy access control list, in front of the payment plugin directories
Deploy WAF rules to block unauthenticated GET requests matching */plugin/*/list.json.php patterns
Place AVideo behind an authenticated reverse proxy that enforces session validation before requests reach the PHP application

bash

# Example nginx location block to require authentication on payment plugin list endpoints
location ~* /plugin/(PayPal|AuthorizeNet|Bitcoin)/.*list\.json\.php$ {
    auth_basic "AVideo Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    deny all;
}