AVideo Open Source Video Platform Vulnerability in PayPal Transaction Handling

CVE-2026-39366

What is CVE-2026-39366?

The PayPal IPN version 1 handler in AVideo, up to version 26.0, is susceptible to transaction replay attacks due to the absence of transaction deduplication. This flaw enables attackers to resend a legitimate IPN notification multiple times, potentially increasing their wallet balance and renewing subscriptions fraudulently. Although the updated handlers in AVideo implement proper deduplication mechanisms, the v1 handler remains active and referenced in billing plans, posing a risk to users. For further details, refer to the commit and advisory linked.

References