{"items":[{"id":"NVI-00002338","kind":"vulnerability","title":"WWBN AVideo Affected by a PayPal IPN Replay Attack Enabling Wallet Balance Inflation via Missing Transaction Deduplication in ipn.php","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-mmw7-wq3c-wf9p","CVE-2026-39366"],"plain_summary":"OSV carries this publisher advisory for wwbn/avideo. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-144c66f658ba531d42b563a058e87aed"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-144c66f658ba531d42b563a058e87aed","url":"https://github.com/advisories/GHSA-mmw7-wq3c-wf9p","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-mmw7-wq3c-wf9p","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.981Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-144c66f658ba531d42b563a058e87aed"],"technology":"wwbn/avideo","known_exclusions":[],"conditions_summary":"## Summary\n\nThe PayPal IPN v1 handler at `plugin/PayPalYPT/ipn.php` lacks transaction deduplication, allowing an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer `ipnV2.php` and `webhook.php` handlers correctly deduplicate via `PayPalYPT_log` entries, but the v1 handler was never updated and remains actively referenced as the `notify_url` for billing plans.\n\n## Details\n\nWhen a recurring payment IPN arrives at `ipn.php`, the handler:\n\n1. Verifies authenticity via `PayPalYPT::IPNcheck()` (line 16), which sends the POST data to PayPal's `cmd=_notify-validate` endpoint. PayPal confirms the data is genuine but this verification is **stateless** — PayPal returns `VERIFIED` for the same authentic data on every submission.\n\n2. Looks up the subscription from `recurring_payment_id` and directly credits the user's wallet (lines 41-53):\n\n```php\n// plugin/PayPalYPT/ipn.php lines 41-53\n$row = Subscription::getFromAgreement($_POST[\"recurring_payment_id\"]);\n$users_id = $row['users_id'];\n$payment_amount = empty($_POST['mc_gross']) ? $_POST['amount'] : $_POST['mc_gross'];\n$payment_currency = empty($_POST['mc_currenc","public_affected_ranges":["ECOSYSTEM: introduced 0; last_affected 26.0"]}],"null_published_at":"2026-10-31T22:00:33.876Z","source_updated_at":"2026-04-08T00:27:16.874Z","source_disclosed_at":"2026-04-08T00:08:33.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.981Z"}],"next_cursor":null,"snapshot_revision":"42594"}