CVE-2026-39366: 
PHP vulnerability analysis and mitigation

CVE-2026-39366 is a PayPal IPN replay attack vulnerability in WWBN AVideo, an open source video platform, that allows low-privileged attackers to fraudulently inflate wallet balances and renew subscriptions without payment. The flaw affects AVideo versions 26.0 and prior, specifically the PayPal IPN v1 handler at plugin/PayPalYPT/ipn.php. It was published on April 7, 2026, with a patch commit available shortly after. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Feedly).

The root cause is classified as CWE-345 (Insufficient Verification of Data Authenticity). The ipn.php handler verifies IPN authenticity by forwarding POST data to PayPal's cmd=_notify-validate endpoint, which returns VERIFIED for the same authentic payload on every submission — making this check stateless and insufficient. After verification, the handler directly calls addBalance() and Subscription::renew() without recording the transaction in PayPalYPT_log or checking for a previously processed txn_id or verify_sign. In contrast, the newer ipnV2.php and webhook.php handlers correctly implement deduplication via PayPalYPT::isTokenUsed() and PayPalYPT::isRecurringPaymentIdUsed(), but the v1 handler was never updated and remains actively referenced as the notify_url in PayPalYPT.php at lines 85, 193, and 308. A public proof-of-concept is included in the GitHub security advisory (GitHub Advisory, Patch Commit).

A low-privileged attacker with at least one completed PayPal subscription can replay a captured IPN notification an unlimited number of times, each replay crediting the subscription amount to their wallet and calling Subscription::renew() to extend their access. This results in unlimited wallet balance inflation, indefinite subscription access from a single payment, and direct financial loss to platform operators who lose revenue for services rendered without corresponding payments. There is no confidentiality or availability impact, but the integrity of the billing and subscription system is severely compromised (GitHub Advisory).

No public exploit kit or in-the-wild exploitation has been observed as of the time of reporting, and no threat actor attribution is available. A detailed proof-of-concept using curl is publicly documented in the GitHub security advisory, demonstrating both single and bulk replay attacks. The EPSS score is approximately 0.014% (0.000140), indicating a currently low probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (GitHub Advisory, Feedly).

1. Prerequisite: Register an AVideo account and complete at least one legitimate PayPal subscription payment to generate a valid IPN notification.
2. Capture IPN POST body: Retrieve the IPN notification data from PayPal's IPN History (PayPal Settings > IPN History) or intercept it via network monitoring during the initial subscription flow. The captured data includes recurring_payment_id, mc_gross, mc_currency, verify_sign, and other fields.
3. Identify the target endpoint: Confirm the vulnerable endpoint is active at https://target.com/plugin/PayPalYPT/ipn.php, which is referenced as the notify_url in the platform's billing plans.
4. Replay the IPN notification: Send the captured POST body to the endpoint using a tool like curl:

   curl -X POST 'https://target.com/plugin/PayPalYPT/ipn.php' \
     -d 'recurring_payment_id=I-XXXXXXXXXX&mc_gross=9.99&mc_currency=USD&payment_status=Completed&txn_type=recurring_payment&verify_sign=REAL_VERIFY_SIGN&payer_email=attacker@example.com'

5. Bulk replay for maximum impact: Loop the request to multiply the credited amount (e.g., 100 replays = 100x the subscription amount added to the wallet and 100 subscription renewals).
6. Outcome: Each replay passes IPNcheck() (PayPal confirms the data is authentic), then addBalance() credits the wallet and Subscription::renew() extends the subscription, granting unlimited paid access without further payment (GitHub Advisory).

• Network: Repeated HTTP POST requests to /plugin/PayPalYPT/ipn.php from the same source IP in rapid succession; requests containing identical recurring_payment_id, verify_sign, and mc_gross values across multiple submissions.
• Logs: AVideo application logs showing multiple PayPalIPN: recurring_payment_id = I-XXXXXXXXXX entries with the same recurring_payment_id in a short time window; absence of corresponding PayPalYPT_log entries for processed transactions (pre-patch systems).
• Database: Abnormally high wallet balance for a user account inconsistent with their payment history; PayPalYPT_log table missing entries for transactions that appear in wallet credit history; Subscription table showing repeated renewals for the same user with no corresponding unique payment records.
• Application Behavior: User accounts with wallet balances or subscription durations far exceeding what their payment history would justify (GitHub Advisory).

The primary remediation is to upgrade WWBN AVideo to a version beyond 26.0 that includes the fix from commit 8f53e9d9c6aaa07d51ace30691981edbbfb5ca1c, which adds txn_id/verify_sign-based deduplication and PayPalYPT_log recording to ipn.php. If immediate patching is not possible, disable the v1 IPN handler (plugin/PayPalYPT/ipn.php) and migrate billing plan notify_url references in PayPalYPT.php (lines 85, 193, 308) to the already-patched ipnV2.php or webhook.php handlers. Additionally, implement network-level controls to restrict IPN submissions to PayPal's known IP ranges and validate PayPal signatures on all incoming notifications (GitHub Advisory, Patch Commit).