PT-2026-138056

CVE-2026-123486

Published

2026-11-06

Updated

2026-11-06

Description by

CVSS 4.0

6.0

Medium

MetricsAV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 through 29.4.0

Description A race condition exists in the plugin/PayPalYPT/ipn.php file. This occurs because the deduplication check and insert process is non-atomic, allowing attackers to bypass Instant Payment Notification (IPN) replay protection. By concurrently replaying a captured valid recurring-payment notification, multiple requests can pass the isRecurringPaymentIdUsed() function, enabling the attacker to obtain duplicate subscription renewals and wallet credits.

Recommendations Update AVideo to a version later than 29.4.0.

Exploitability

Exploit

Fix

Impacts

Researchers

Vectrain51

Vendors

Affected products

Weakness enumeration

CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition

Related identifiers