CVE-2026-123486

EUVD-2026-118286
WWBN AVideo 29.0 through 29.4.0 contains a race condition vulnerability in plugin/PayPalYPT/ipn.php that allows attackers to bypass IPN replay protection due to a non-atomic deduplication check and insert. Attackers can concurrently replay a captured valid recurring-payment notification so both requests pass isRecurringPaymentIdUsed(), obtaining duplicate wallet credits and subscription renewals.
TOCTOU
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.3 MEDIUM
NETWORK
HIGH
LOW
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources (CNA/ADP records, vendor advisories, Enginsight analysis).
VendorProductVersionSource
wwbnavideo
29.0 ≤
𝑥
≤ 29.4.0
CNA
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/security/advisories/GHSA-q77r-9mjq-mjw6
https://www.vulncheck.com/advisories/wwbn-avideo-29.0-through-29.4.0-race-condition-in-paypal-ipn-deduplication-via-ipn-php