CVE-2026-56346
AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint
- State
- Published
- Severity
- 6.9 Medium
- Published
- Jun 20, 2026
- Updated
- Jul 8, 2026
- Reserved
- Jun 20, 2026
Description
AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 6.9 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L | VulnCheck |
Weaknesses
- CWE-306 Missing Authentication for Critical Function
Affected Products
| Product | Versions |
|---|---|
AVideoAVideo |
|
References
- GHSA Advisory GHSA-5x2w-37xf-7962vendor-advisory
- VulnCheck Advisory: AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpointthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.