CVE-2026-56341highCWE-862

CVE-2026-56341: high-severity vulnerability in AVideo

AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php

Published · Updated

Follow this CVE+ Monitor AVideo+ Monitor wwbn/avideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.7epss 0.5%
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
AVideo · AVideo
Related CVEs — AVideo

In the same product, most dangerous first.

CVE-2026-56346MEDIUMAVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php EndpointEPSS 0.6%CVE-2026-56345CRITICALAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo EndpointEPSS 0.5%CVE-2026-56342MEDIUMAVideo - Server-Side Request Forgery in Live/test.php via statsURL ParameterEPSS 0.4%CVE-2026-60092MEDIUMAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelEPSS 0.3%