CVE-2026-56341CWE-862

AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php

High · published June 20, 2026

CVSS v4.0
8.7
EPSS
0%
Percentile
38.8
In the wild
Unconfirmed
What it is

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00459 · 38.8th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-06-20T18:27Z
EPSS history
Timeline
  • 20 JUN 18:27Z
    AVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php
    cvelistv5