Insufficient verification of data authenticity in AVideo - CVE-2026-33731
Published: November 11, 2026
Vulnerability identifier: #VU165923
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-33731
CWE-ID: CWE-345
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to inflate arbitrary users' wallet balances and activate premium subscriptions without corresponding payment.
The vulnerability exists due to insufficient verification of data authenticity in AVideo's Authorize.Net webhook handler when processing notifications, allowing successful transaction lookups to bypass signature validation while trusting payload values and omitting approval checks. A remote user can submit a forged webhook before the legitimate notification, using a transaction ID from a small purchase and manipulated amount, users_id, or plans_id fields to obtain unauthorized wallet credits or subscriptions.
Affected software
AVideo
How to mitigate CVE-2026-33731
Install security update from vendor's website.
AVideo - update to 29.0