CVE-2026-33731

{
  "id": "CVE-2026-33731",
  "sourceIdentifier": "[email protected]",
  "published": "2026-07-16T21:17:20.317",
  "lastModified": "2026-10-24T20:10:00.137",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions prior to 29.0, the Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. By supplying a valid transaction ID from a small legitimate purchase, the attacker bypasses signature validation and credits arbitrary wallet balances to any user account via attacker-controlled payload fields. Three flaws combine into an exploit chain: signature bypass via OR logic (webhook.php:33), payload values override API-fetched values (AuthorizeNet.php:169-171, webhook.php:44-48) and a missing approval check (webhook.php:61-75). By forging payment metadata, an attacker can credit arbitrary amounts to any user's wallet without a corresponding payment and include a  plans_id  to activate premium subscriptions (webhook.php:86-134), enabling free access to all paid and premium content and causing direct revenue loss to the platform owner. This issue has been fixed in version 29.0."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones anteriores a la 29.0, el gestor de webhooks de Authorize.Net en plugin/AuthorizeNet/webhook.php contiene una omisión de verificación de firma que permite a un atacante falsificar solicitudes de webhook con cantidades de pago arbitrarias e IDs de usuario objetivo. Al proporcionar un ID de transacción válido de una pequeña compra legítima, el atacante omite la validación de firma y acredita saldos de monedero arbitrarios a cualquier cuenta de usuario a través de campos de carga útil controlados por el atacante. Tres fallos se combinan en una cadena de exploit: omisión de firma a través de lógica OR (webhook.php:33), los valores de la carga útil anulan los valores obtenidos por la API (AuthorizeNet.php:169-171, webhook.php:44-48) y una verificación de aprobación faltante (webhook.php:61-75). Al falsificar metadatos de pago, un atacante puede acreditar cantidades arbitrarias al monedero de cualquier usuario sin un pago correspondiente e incluir un plans_id para activar suscripciones premium (webhook.php:86-134), lo que permite el acceso gratuito a todo el contenido de pago y premium y causando una pérdida directa de ingresos al propietario de la plataforma. Este problema ha sido solucionado en la versión 29.0."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "< 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-17T11:11:59.098349Z",
          "id": "CVE-2026-33731",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-345"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/033e83ae904cacb99495dbea7cbcfb3738cf42e4",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-95jh-7r58-xmxw",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-95jh-7r58-xmxw",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}