Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56341AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php

High 7.5

In plain English

A high-severity missing authorization in AVideo from AVideo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.5%top 60.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-wprj-9cvc-5w37

Affected products (as reported)

Vendor	Product	Versions
AVideo	AVideo	0 – through 26.0

Weakness: CWE-862 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GHSA Advisory GHSA-wprj-9cvc-5w37 vendor-advisory
VulnCheck Advisory: AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php third-party-advisory