CVE-2026-43883— WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-43883
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to Cancel Arbitrary PayPal Subscription Agreements
Source: NVD (National Vulnerability Database)
Vulnerability Description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/PayPalYPT/agreementCancel.json.php cancels a PayPal billing agreement using an attacker-supplied agreement parameter without verifying that the authenticated user owns the agreement. A low-privilege authenticated user who learns or obtains another user's PayPal billing agreement ID can silently suspend the victim's recurring subscription, causing revenue loss to the platform and loss of paid service to the victim. Commit 0da3dcff1eda2f497694bf82b559829471c292c2 contains an updated fix.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
WWBN AVideo 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WWBN AVideo是WWBN团队的一个由PHP编写的视频平台建站系统。 WWBN AVideo 29.0及之前版本存在安全漏洞，该漏洞源于plugin/PayPalYPT/agreementCancel.json.php未验证用户所有权，可能导致低权限用户取消其他用户的PayPal订阅。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-43883
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-43883
请登录查看更多情报信息。
- https://github.com/WWBN/AVideo/security/advisories/GHSA-958h-qp3x-q4gjx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-43883
Same Patch Batch · WWBN · 2026-05-11 · 13 CVEs total
| CVE-2026-43884 | 7.7 HIGH | WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() |
| CVE-2026-43873 | 7.5 HIGH | WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClien |
| CVE-2026-43874 | 7.2 HIGH | WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross- |
| CVE-2026-43875 | 6.8 MEDIUM | WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Take |
| CVE-2026-43876 | 6.4 MEDIUM | WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishin |
| CVE-2026-43878 | 6.1 MEDIUM | WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameter |
| CVE-2026-43879 | 5.4 MEDIUM | WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check an |
| CVE-2026-43877 | 5.4 MEDIUM | WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User |
| CVE-2026-43881 | 5.3 MEDIUM | WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` |
| CVE-2026-43880 | 5.3 MEDIUM | WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishin |
| CVE-2026-43882 | 4.3 MEDIUM | WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calend |
| CVE-2026-43885 | WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Author |
IV. Related Vulnerabilities
Same product: AVideo
- CVE-2026-43885
WWBN AVideo: Exposure of Sensitive Information to an Unautho - CVE-2026-43884
WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DN - CVE-2026-43882
WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler - CVE-2026-43881
WWBN AVideo: Unauthenticated User Enumeration in `objects/us - CVE-2026-43880
WWBN AVideo: Unauthenticated Arbitrary Email Sending via sen
Same vendor: WWBN
- CVE-2026-43885
WWBN AVideo: Exposure of Sensitive Information to an Unautho - CVE-2026-43884
WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DN - CVE-2026-43882
WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler - CVE-2026-43881
WWBN AVideo: Unauthenticated User Enumeration in `objects/us - CVE-2026-43880
WWBN AVideo: Unauthenticated Arbitrary Email Sending via sen
Same weakness: CWE-639
- CVE-2026-45666
Open WebUI: Indirect Object Reference (IDOR) in user notes - CVE-2026-44570
Open WebUI: Inconsistent authorization controls within memor - CVE-2026-45402
Open WebUI: Cross-User File Access via Unchecked file_id in - CVE-2026-45386
Open WebUI: An IDOR vulnerability exists in the pin_channel_ - CVE-2026-45398
Open WebUI: IDOR - Retrieval API Bypasses Knowledge Base Acc
V. Comments for CVE-2026-43883
No comments yet