AVideo prior to version 29.0 contains a flaw in its Authorize.Net webhook handler that bypasses signature verification through an OR logic condition, allowing an attacker to forge requests with arbitrary payment amounts and target user IDs. By supplying a valid transaction ID from a legitimate small purchase, the attacker defeats signature validation and can credit arbitrary wallet balances to any user account via attacker-controlled payload fields. The vulnerability arises from a chain of three flaws: the signature bypass via OR logic (webhook.php:33), payload values that override API-fetched values (AuthorizeNet.php:169‑171 and webhook.php:44‑48), and a missing approval check (webhook.php:61‑75). An attacker can also include a plans_id to activate premium subscriptions (webhook.php:86‑134), granting free access to paid and premium content, causing direct revenue loss to the platform owner. This weakness is classified as CWE‑345, indicating unauthorized modification of evidence such as payment metadata.

The vulnerable product is the open‑source video platform AVideo from WWBN. All installations running any version prior to 29.0 are vulnerable; newer releases incorporate the fix and are considered secure. The malicious activity targets the Authorize.Net webhook handler located at plugin/AuthorizeNet/webhook.php.

The attack vector is forging HTTP POST requests to the publicly exposed Authorize.Net webhook endpoint. An attacker needs only to craft a request that includes a valid transaction ID from a legitimate purchase and exploits the OR logic signature bypass to skip validation. The payload override and missing approval check create a chain that lets the attacker set arbitrary payment amounts, target user IDs, and plan identifiers, thereby inflating wallet balances and activating premium subscriptions without actual payment. The CVSS score of 6.5 reflects medium severity; the EPSS score of <1% indicates a low current exploitation likelihood, and the vulnerability is not listed in the CISA KEV catalog. Successful exploitation results in unauthorized wallet credit, free premium content access, and direct revenue loss.