CVE-2026-35448

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-35448", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-02T19:25:52.192Z", "datePublished": "2026-04-06T21:45:01.877Z", "dateUpdated": "2026-04-07T15:08:51.870Z"}, "containers": {"cna": {"title": "WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php", "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "lang": "en", "description": "CWE-862: Missing Authorization", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9"}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"version": "<= 26.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T21:45:01.877Z"}, "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform."}], "source": {"advisory": "GHSA-3v7m-qg4x-58h9", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-07T14:37:28.857671Z", "id": "CVE-2026-35448", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T15:08:51.870Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-35448", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-07T14:37:28.857671Z"}}}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-07T14:37:38.702Z"}}], "cna": {"title": "WWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php", "source": {"advisory": "GHSA-3v7m-qg4x-58h9", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "WWBN", "product": "AVideo", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "references": [{"url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9", "name": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "CWE-862: Missing Authorization"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-06T21:45:01.877Z"}}}, "cveMetadata": {"cveId": "CVE-2026-35448", "state": "PUBLISHED", "dateUpdated": "2026-04-07T15:08:51.870Z", "dateReserved": "2026-04-02T19:25:52.192Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-06T21:45:01.877Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "AVideo", "vendor": "WWBN", "versions": [{"status": "affected", "version": "<= 26.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*", "matchCriteriaId": "774C24F1-9D26-484F-B931-1DA107C8F588", "versionEndIncluding": "26.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "WWBN AVideo is an open source video platform. In versions 26.0 and prior, the BlockonomicsYPT plugin's check.php endpoint returns payment order data for any Bitcoin address without requiring authentication. The endpoint was designed as an AJAX polling helper for the authenticated invoice.php page, but it performs no access control checks of its own. Since Bitcoin addresses are publicly visible on the blockchain, an attacker can query payment records for any address used on the platform."}, {"lang": "es", "value": "WWBN AVideo es una plataforma de video de c\u00f3digo abierto. En las versiones 26.0 y anteriores, el endpoint check.php del plugin BlockonomicsYPT devuelve datos de \u00f3rdenes de pago para cualquier direcci\u00f3n de Bitcoin sin requerir autenticaci\u00f3n. El endpoint fue dise\u00f1ado como un asistente de sondeo AJAX para la p\u00e1gina invoice.php autenticada, pero no realiza sus propias comprobaciones de control de acceso. Dado que las direcciones de Bitcoin son p\u00fablicamente visibles en la cadena de bloques, un atacante puede consultar los registros de pago para cualquier direcci\u00f3n utilizada en la plataforma."}], "id": "CVE-2026-35448", "lastModified": "2026-07-24T21:10:00.143", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.7, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-35448", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-07T14:37:28.857671Z", "version": "2.0.3"}}]}, "published": "2026-04-06T22:16:23.157", "references": [{"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-3v7m-qg4x-58h9"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,26.0]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "AVideo", "source": "cna", "vendor": "WWBN"}, "product": "avideo", "vendor": "wwbn"}], "analysis": {"en": {"generated_at": "2026-04-14T21:45:14.865088+00:00", "value": {"mitigation_remediation": ["Upgrade AVideo to the latest version, which includes proper authentication for the BlockonomicsYPT check.php endpoint.", "If an immediate upgrade is not possible, restrict or disable external access to the /check.php script, ensuring it can be reached only from trusted internal sources."], "summary": {"action": "Patch", "impact": "Unauthenticated data disclosure"}, "threat_synthesis": {"affected_systems": "The vulnerability exists in WWBN\u2019s open\u2011source AVideo platform, affecting all releases 26.0 and earlier. Users running the BlockonomicsYPT plugin on those versions are exposed until they upgrade to later releases where the access restriction is enforced.", "description_and_impact": "The BlockonomicsYPT plugin\u2019s check.php script returns payment order data for any Bitcoin address without performing authentication checks. The endpoint was intended only for internal AJAX use on a protected invoice page but lacks access control, allowing any requester to obtain transaction records tied to addresses listed on the platform. The weakened confidentiality can expose users\u2019 payment history and potentially sensitive financial information.", "risk_and_exploitability": "The CVSS score of 3.7 indicates low severity, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The issue is not listed in the CISA KEV catalog, reinforcing its lower threat standing. The attack vector is a simple HTTP request to the publicly reachable /check.php endpoint, requiring no credentials. An attacker can enumerate any Bitcoin address that appears in the platform\u2019s blockchain view, retrieving its associated payment orders without needing to authenticate or compromise the host system."}}}}, "created": "2026-04-07T06:53:42.234672+00:00", "updated": "2026-04-15T16:30:09.736240+00:00", "vendors": ["wwbn", "wwbn$PRODUCT$avideo"]}