CVE-2026-56341 | AVideo through version 26.0 contains multiple unauthenticate… | CVSS 7.5 HIGH

Description

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

Metadata

CVE ID: CVE-2026-56341
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-20 13:13 UTC
Published: 2026-06-20 18:27 UTC
Last updated: 2026-06-20 18:27 UTC
Primary CWE: CWE-862
Missing Authorization
Vendor / Product: AVideo / AVideo
Sources: cve.org · NVD

Severity & Metrics

7.5 HIGH CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products (1)

Vendor	Product	Platform	Versions
AVideo	AVideo	—	0 ≤ 26.0

Weakness (CWE)

CWE	Source	Description
CWE-862	cna	Missing Authorization

CVSS scores (2)

Score	Severity	Version	Source	Vector
8.7	HIGH	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
7.5	HIGH	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References (2)

GHSA Advisory GHSA-wprj-9cvc-5w37 https://github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37
VulnCheck Advisory: AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php https://www.vulncheck.com/advisories/avideo-unauthenticated-access-to-payment-log-datatables-endpoints-via-list-json-php