EUVD-2026-322763

fkie_cve-2026-47696

WWBN AVideo is an open source video platform. In 29.0 and earlier, plugin/AuthorizeNet/processPayment.json.php credits the logged-in user's wallet based only on the attacker-controlled amount POST parameter. The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record. This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.

GHSA-9392-pj54-qqf8 — WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

Affected: Packagist: WWBN/AVideo

### Summary

`plugin/AuthorizeNet/processPayment.json.php` credits the logged-in user's wallet based only on the attacker-controlled `amount` POST parameter.

The endpoint contains a TODO for real Authorize.Net charging, hardcodes `$paymentSuccess = true`, and then calls `YPTWallet::addBalance()` without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record.

This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the `AuthorizeNet` and `YPTWallet` plugins are enabled.

### Details

Affected file:

`plugin/AuthorizeNet/processPayment.json.php`

Relevant code:

```php $amount = isset($_POST['amount']) ? floatval($_POST['amount']) : 0; $userData = isset($_POST['userData']) ? $_POST['userData'] : [];

if ($amount <= 0) { echo json_encode(['error' => 'Invalid amount']); exit; }

// TODO: Implement payment logic using Authorize.Net API // Example: Call Authorize.Net API here // $result = $plugin->chargePayment($amount, $userData);

// Simulate payment success for now $paymentSuccess = true; $users_id = @User::getId();

if ($paymentSuccess && !empty($users_id)) { $walletPlugin = AVideoPlugin::loadPluginIfEnabled("YPTWallet"); if ($walletPlugin) { $walletPlugin->addBalance($users_id, $amount, 'Authorize.Net one-time payment'); echo json_encode(['success' => true, 'result' => 'Payment processed and wallet…

Most recent entries from all

EUVD-2026-322763

fkie_cve-2026-47696

GHSA-9392-pj54-qqf8 — WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint