The vulnerability resides in the transferBalance function of the AVideo platform’s YPTWallet plugin, where a Time‑of‑Check‑Time‑of‑Use race condition allows a user with multiple authenticated sessions to initiate simultaneous transfers. Each transfer reads the sender’s balance, verifies sufficient funds, and then writes the new balance without any locking mechanism. Because all concurrent requests read the same original balance, the balance check passes for each and only one deduction actually occurs, while the recipient receives the full amount multiple times. This can lead to the sender’s wallet being drained and the recipient gaining funds in excess, effectively causing a double‑spend scenario.

All installations of the WWBN AVideo platform running version 26.0 or earlier are affected. The issue is present in the YPTWallet plugin’s transferBalance method within those releases. Upgrading to a later version that includes the patch (commit 34132ad5159784bfc7ba0d7634bb5c79b769202d or a release built from it) removes the race condition.

The CVSS score of 5.3 places the vulnerability in the moderate range, and the EPSS score of less than 1% indicates a low likelihood of exploitation. The attack requires an attacker to be authenticated within the affected AVideo installation and to coordinate multiple concurrent transfer requests, which is feasible but not trivial. The vulnerability is not listed in the CISA KEV catalog, so no undisclosed exploitation is known. As the weakness is a TOCTOU race condition (CWE‑362), the primary vector is through network requests that trigger the transferBalance function.