Medium severity · published May 11, 2026
CVE-2026-43883
WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
4.2
CVSS
0.2%
EPSS
No
On KEV
Description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim. Commit 0da3dcff1eda2f497694bf82b559829471c292c2 contains an updated fix.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 10% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AV
AVideo · WWBN
<= 29.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-43883
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-43883
github.com
https://github.com/WWBN/AVideo/commit/0da3dcff1eda2f497694bf82b559829471c292c2
github.com
https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gj
More from AVideo
10.0
CVE-2026-40911
WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaScript Execution via Client-Side eval() Sinks
10.0
CVE-2026-33478
AVideo Multi-Chain Attack: Unauthenticated Remote Code Execution via Clone Key Disclosure, Database Dump, and Command Injection
9.9
CVE-2022-30547
A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364
9.8
CVE-2026-86189
WWBN AVideo Unauthenticated Path Traversal via notify.ffmpeg.json.php
9.8
CVE-2026-85154
WWBN AVideo Authentication Bypass via Non-Expiring video_id_hash