CVE-2026-47696: WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

June 4, 2026

plugin/AuthorizeNet/processPayment.json.php credits the logged-in user’s wallet based only on the attacker-controlled amount POST parameter.

The endpoint contains a TODO for real Authorize.Net charging, hardcodes $paymentSuccess = true, and then calls YPTWallet::addBalance() without validating any Authorize.Net transaction, webhook signature, hosted payment token, nonce, or server-side payment record.

This allows any logged-in user to add arbitrary funds to their own AVideo wallet when the AuthorizeNet and YPTWallet plugins are enabled.

References

Code Behaviors & Features

Detect and mitigate CVE-2026-47696 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →