CVE-2026-39366 WWBN CVE debrief

Who should care

Users of WWBN AVideo versions 26.0 and prior should be aware of this vulnerability, as it allows attackers to replay legitimate IPN notifications and potentially inflate their wallet balance and renew subscriptions. Affected operator, platform, vulnerability-management, and security-team impact should be carefully reviewed to ensure that all necessary precautions are taken.

Technical summary

The PayPal IPN v1 handler in WWBN AVideo versions 26.0 and prior lacks transaction deduplication. This allows an attacker to replay a single legitimate IPN notification to repeatedly inflate their wallet balance and renew subscriptions. The newer ipnV2.php and webhook.php handlers correctly deduplicate via PayPalYPT_log entries, but the v1 handler was never updated and remains actively referenced as the notify_url for billing plans. The vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.

Defensive priority

Medium priority should be given to updating or patching the affected WWBN AVideo installations, as the vulnerability has a CVSS score of 6.5 and is classified as MEDIUM severity.

Recommended defensive actions

• Update WWBN AVideo to a version beyond 26.0 or apply patches to disable the outdated IPN v1 handler.
• Review and update billing plans to use newer, deduplicated handlers (ipnV2.php or webhook.php).
• Monitor for suspicious IPN notifications and implement additional logging and monitoring to detect potential replay attacks.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD details provide evidence of the vulnerability and its impact. However, further verification is needed to confirm the affected scope and ensure that all instances of WWBN AVideo have been updated or patched. The lack of transaction deduplication in the PayPal IPN v1 handler allows for replay attacks, which could lead to inflated wallet balances and renewed subscriptions. Evidence limits suggest that additional verification tasks are necessary to confirm the vulnerability's impact and ensure that all affected systems are properly secured.

Official resources