What is GHSA-rg7q-4223-phjw?

GHSA-rg7q-4223-phjw is a security advisory published by GitHub Security Advisories with High severity. AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment...

Which CVE IDs does GHSA-rg7q-4223-phjw cover?

GHSA-rg7q-4223-phjw covers the following CVE IDs: CVE-2026-56341. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rg7q-4223-phjw?

GHSA-rg7q-4223-phjw has a CVSS v3 base score of 7.5, published by GitHub Security Advisories.

GHSA-rg7q-4223-phjwHighCVSS 7.5

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment...

Vendor

GitHub Security Advisories

Published

June 20, 2026

Last Modified

June 20, 2026

🔗 CVE IDs covered (1)

CVE-2026-56341 →

📋 Description

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all payment transaction data including agreement IDs, user financial records, and API responses via direct GET requests to vulnerable endpoints.

🔗 References (4)

https://github.com/WWBN/AVideo/security/advisories/GHSA-wprj-9cvc-5w37
https://nvd.nist.gov/vuln/detail/CVE-2026-56341
https://www.vulncheck.com/advisories/avideo-unauthenticated-access-to-payment-log-datatables-endpoints-via-list-json-php
https://github.com/advisories/GHSA-rg7q-4223-phjw