An unauthenticated information disclosure vulnerability in AVideo exposes sensitive payment and financial transaction data to unauthorized attackers.

The vulnerability involves multiple unauthenticated list.json.php endpoints within payment plugins that lack proper authorization checks. Unauthenticated remote attackers can perform direct GET requests to retrieve PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records.

Successful exploitation allows unauthorized access to critical financial data, including user financial records, agreement IDs, and API responses. With a CVSS score of 7.5, this high-severity flaw poses a significant risk of data breach, potential financial loss for users, and severe regulatory non-compliance regarding the handling of financial information.

Immediate Action: Review the official vendor advisory at https://github.com/advisories/GHSA-rg7q-4223-phjw and apply available security updates or configuration changes provided by AVideo.

Proactive Monitoring: Monitor server access logs for anomalous GET requests directed at list.json.php files within the payment plugin directory.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block unauthorized access attempts to list.json.php endpoints.

Public Exploit Available: false

Given the exposure of sensitive financial data, organizations using AVideo must treat this vulnerability with high priority. Administrators should restrict access to payment-related endpoints immediately and ensure all software is updated to the latest secure version once released by the vendor.