CVE-2026-47696: WWBN AVideo: Authenticated wallet credit bypass in AuthorizeNet processPayment endpoint

Synopsis

This is an authenticated business-logic bypass in WWBN AVideo's AuthorizeNet payment plugin. Any logged-in user can POST to plugin/AuthorizeNet/processPayment.json.php and have the supplied amount credited directly to their wallet, because the endpoint hardcodes payment success and never validates an actual Authorize.Net transaction, webhook signature, or server-side payment record. Successful exploitation lets attackers inflate their own wallet balance to arbitrary values, corrupting revenue and accounting data. No upstream fix is published yet; HarborGuard tracks the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the AVideo processPayment.json.php endpoint over the network, typically the same HTTP(S) surface that serves the video platform.

• AuthenticationRequired

  Any low-privilege logged-in AVideo user account is sufficient; no admin role is needed.

• Victim interactionNot required

  The attacker acts entirely against their own session and wallet, with no other user needing to click or do anything.

• Attack complexityDetail

  Attack complexity is low: a single crafted POST with an amount parameter reliably credits the wallet, with no race or memory-layout conditions.

Blast Radius

• Attackers arbitrarily inflate their own AVideo wallet balance by submitting any amount value, with no real funds moving.
• Wallet ledgers, revenue reports, and any downstream payout or entitlement logic tied to wallet balance become untrustworthy.
• Confidentiality and availability are not directly affected; the damage is integrity of financial state inside AVideo.