The vulnerability is a time‑of‑check time‑of‑use race condition in the transferBalance method of the YPTWallet plugin. An attacker running multiple authenticated sessions can trigger simultaneous transfer requests. Each request reads the sender's wallet balance before the balance is actually deducted, ensuring that all balance checks succeed. The deduction is applied only once, while the recipient receives the full amount for each request, effectively creating a double‑spend. This leads to unauthorized financial loss for the sender and possible over‑crediting for the recipient.

Affected products are WWBN AVideo versions 26.0 and earlier, specifically the YPTWallet plugin's transferBalance function. All deployments of this open source video platform before the referenced commit lack transaction protection or row‑level locking.

The CVSS score of 5.3 indicates moderate severity, and no EPSS score is available, making it unclear how frequently attackers target this flaw. The issue is not listed in the CISA KEV catalog, suggesting no publicly known exploitation. The likely attack vector requires an attacker to be authenticated and to manage multiple sessions or parallel requests against the same account, which can be achieved through standard web interactions. Because the vulnerability depends on race timing and concurrent access, it is less likely to be easily exploited but still poses a financial risk if used by a determined adversary.