CVE-2026-123486: WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php

Published Nov 6, 2026

Updated

WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.

Event History

Nov 6, 2026

CVE Published

via MITRE·03:00 PM

Data Sourced

via MITRE·03:00 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to capture a valid recurring-payment PayPal IPN notification and replay it concurrently. The concurrent requests can both pass the non-atomic recurring-payment ID check before either request records the ID as used.

What is the practical impact of a successful exploit?

Successful concurrent replays can result in duplicate wallet credits and duplicate subscription renewals.

CVE-2026-123486: WWBN AVideo 29.0 through 29.4.0 Race Condition in PayPal IPN Deduplication via ipn.php

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the practical impact of a successful exploit?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the practical impact of a successful exploit?