CVE-2026-56341

—

CVSS 4.0

8.7 high

EPSS

<1%p39

Published

Jun 20, 2026 (Jun 20, 2026)

Modified

Sep 9, 2026

Description

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

Ecosystems: composer
Weakness: CWE-862
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
GHSA: GHSA-wprj-9cvc-5w37 (high)

NVD CVE.org GitHub PoCs EPSS (0.5%)

In the news0 stories

No ingested article mentions this CVE yet.