High severity7.5NVD Advisory· Published Jun 20, 2026· Updated Jun 22, 2026
CVE-2026-56341
CVE-2026-56341
Description
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-wprj-9cvc-5w37ghsaADVISORY
- github.com/WWBN/AVideo/commit/1729a955f8de7e26552eb728b3d1e6f4b1b9352eghsa
- github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37nvd
- github.com/advisories/GHSA-j724-5c6c-68g5ghsa
- nvd.nist.gov/vuln/detail/CVE-2026-56341ghsa
- www.vulncheck.com/advisories/avideo-unauthenticated-access-to-payment-log-datatables-endpoints-via-list-json-phpnvd
News mentions
1- AVideo: Five Unpatched Flaws Disclosed — Auth Bypass, SSRF, Payment Data Leak, and XSSVypr Intelligence · Jun 20, 2026