Which versions of AVideo are affected by CVE-2026-56345?

AVideo Meet plugin (versions 29.0 and prior) contains an authorization bypass allowing remote attackers to hijack arbitrary user sessions, including administrative accounts, by exploiting the…

How to fix or mitigate CVE-2026-56345?

Within 24 hours: Identify all systems running AVideo with Meet plugin and document versions deployed. Within 7 days: Restrict network access to uploadRecordedVideo.json.php via firewall/WAF rules; disable Meet plugin if operationally feasible. Within 30 days: Monitor vendor security advisories for patch availability and conduct comprehensive review of file access controls on configuration.php.

AVideo CVE-2026-56345

Q: What is the CVSS score of CVE-2026-56345?

CVE-2026-56345 has a CVSS 4.0 base score of 9.2 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-38132 CRITICAL

Improper Authentication (CWE-287)

2026-06-20 VulnCheck

Authentication Bypass PHP File Upload Avideo

9.2

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.2 CRITICAL

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.1 HIGH

Network-reachable endpoint with no auth (PR:N, UI:N), but AC:H because the attacker must first obtain the Meet shared secret; full admin takeover yields C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 05:54 vuln.today

Analysis Generated

Jun 22, 2026 - 05:54 vuln.today

DescriptionCVE.org

AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filename like '1-anything.mp4' to hijack admin sessions and gain full account takeover.

AnalysisAI

Authorization bypass in AVideo's Meet plugin (versions through 29.0) lets remote attackers hijack arbitrary user sessions, including admin, by abusing the uploadRecordedVideo.json.php endpoint which derives the target users_id from a caller-controlled filename and then invokes the passwordless User->login() path. Exploitation requires the Meet shared secret, but that secret is a deterministic MD5 of values from configuration.php and is recoverable via known path-traversal flaws or timing attacks against checkToken.json.php. No public exploit identified at time of analysis, though the VulnCheck and GHSA advisories document the attack with code-level precision.

Technical ContextAI

AVideo is an open-source PHP video-streaming/CMS platform (cpe:2.3:a:avideo:avideo). The Meet plugin integrates Jitsi-style conferencing and exposes plugin/Meet/uploadRecordedVideo.json.php for a Meet/Jitsi recorder to POST finished recordings back to AVideo using a single shared bearer secret (Meet->secret = md5(systemRootPath + salt + 'meet')). Once that secret matches, the handler parses the target user id with $users_id = explode('-', $_FILES['upl']['name'])[0] and calls $userObject->login(true, true), which is User::login's no-password branch (objects/user.php lines 1276-1310) that sets $_SESSION['user'], calls setUserCookie() and _session_regenerate_id(), returning a valid PHPSESSID to the caller. This is a textbook CWE-287 (Improper Authentication) - the service-to-service auth model proves the caller knows a shared secret but never binds that proof to the user being credited, conflating channel authentication with identity assertion.

RemediationAI

No vendor-released patch identified at time of analysis - the GHSA advisory lists fixed-in as None and the composer package shows no patched release for WWBN/AVideo. Until a fix ships, operators should disable the Meet plugin via AVideoPlugin (the endpoint short-circuits with 'Plugin disabled' when Meet is not enabled, eliminating the attack surface at the cost of losing conferencing/recording functionality), or block external access to /plugin/Meet/uploadRecordedVideo.json.php and /plugin/Meet/checkToken.json.php at the reverse proxy/WAF and restrict them to the Jitsi recorder's source IP (trade-off: legitimate recorder callbacks from other networks will fail). Rotate the values feeding Meet->secret (systemRootPath and $global['salt'] in videos/configuration.php) after confirming no path-traversal exposure such as GHSA-83xq-8jxj-4rxm or GHSA-4wmm-6qxj-fpj4 remains unpatched, and audit recent sessions for admin logins originating from unexpected IPs. Track the upstream advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-qxvm-r42f-5p8j for the eventual code fix.