CVE-2026-56346mediumCWE-306

CVE-2026-56346: medium-severity vulnerability in AVideo

AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint

Published · Updated

Follow this CVE+ Monitor AVideo+ Monitor wwbn/avideo

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.9epss 0.6%
AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N
Affected products
AVideo · AVideo
Related CVEs — AVideo

In the same product, most dangerous first.

CVE-2026-56341HIGHAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.phpEPSS 0.5%CVE-2026-56345CRITICALAVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo EndpointEPSS 0.5%CVE-2026-56342MEDIUMAVideo - Server-Side Request Forgery in Live/test.php via statsURL ParameterEPSS 0.4%CVE-2026-60092MEDIUMAVideo - Stored Cross-Site Scripting via Unescaped User-Agent in Participants PanelEPSS 0.3%