CVE-2026-56341: AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Implement server-side authentication and authorization checks on all list.json.php endpoints in AVideo payment plugins so that unauthenticated GET requests cannot retrieve payment transaction data (agreement IDs, API responses, user financial records).
AVideo payment plugin endpoints (list.json.php) authorization_required = true - Compensating control
Block or restrict external access to payment plugin list.json.php endpoints at the perimeter (web application firewall, reverse proxy, or web server). Configure rules to allow access only for authenticated/authorized users or trusted management IP ranges to prevent unauthenticated retrieval of payment data.
- Operational
Assume PayPal tokens, Authorize.Net webhook secrets, and Bitcoin transaction records may have been exposed. Revoke/rotate any exposed PayPal tokens and Authorize.Net webhook keys, review affected transactions for fraud or misuse, and notify impacted users as appropriate.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56341?
CVE-2026-56341 has a high severity rating of 7.5.
How do I fix CVE-2026-56341?
To fix CVE-2026-56341, you should update to the latest version of AVideo that addresses the vulnerability.
What data is exposed in CVE-2026-56341?
CVE-2026-56341 exposes sensitive payment transaction data such as PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records.
Can an unauthenticated attacker exploit CVE-2026-56341?
Yes, an unauthenticated attacker can exploit CVE-2026-56341 to access payment log data.
Which versions of AVideo are affected by CVE-2026-56341?
AVideo versions prior to 26.0 are affected by CVE-2026-56341.