CVE-2026-123486

5.3 MEDIUMpublic exploit available

Published 2026-11-06 · Updated 2026-11-11

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N

Weaknesses

CWE-367

Public exploit & PoC references

https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6
https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6

All references

https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6
https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-paypal-ipn-deduplication-via-ipn-php
https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

UNSCOREDCVE-2025-54506
UNSCOREDCVE-2025-68404
UNSCOREDCVE-2026-100235
HIGHCVE-2026-100597PoC
HIGHCVE-2026-100713PoC
MEDIUMCVE-2026-101029PoC
MEDIUMCVE-2026-101088PoC
MEDIUMCVE-2026-101308

Related by shared AI tags and CWE weakness class. Browse the full archive.