AVideo CVE-2026-56346

Q: What is the CVSS score of CVE-2026-56346?

CVE-2026-56346 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-38133 MEDIUM

Missing Authentication for Critical Function (CWE-306)

2026-06-20 VulnCheck

PHP Authentication Bypass Denial Of Service Avideo

6.9

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-accessible endpoint requires no auth (PR:N, AV:N); impact is limited confidentiality from log exposure and partial availability from CPU exhaustion, no integrity effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 06:26 vuln.today

Analysis Generated

Jun 22, 2026 - 06:26 vuln.today

DescriptionCVE.org

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.

AnalysisAI

Unauthenticated PGP decryption exposure in AVideo through version 25.0 allows any remote attacker to submit private key material, ciphertext, and passphrases to the publicly accessible decryptMessage.json.php endpoint and receive plaintext in the server response - no credentials, session, or token required. The dual impact is confidentiality loss (private key material processed in server memory may be captured in application or web server logs) and availability degradation via unconstrained CPU consumption from repeated cryptographic operations. A publicly available proof-of-concept exists per the GHSA advisory; no vendor patch has been released as of this analysis.

Technical ContextAI

AVideo is an open-source PHP video platform (composer package wwbn/avideo) built around a plugin architecture. The affected component is the LoginControl plugin's PGP endpoint at /plugin/LoginControl/pgp/decryptMessage.json.php, which accepts a JSON POST body containing three fields: textToDecrypt, privateKeyToDecryptMsg, and keyPassword. The server passes these directly to a decryptMessage() routine without any preceding call to User::isLogged() or equivalent session validation - a textbook CWE-306 (Missing Authentication for Critical Function) defect. The affected CPE is cpe:2.3:a:avideo:avideo:*:*:*:*:*:*:*:* covering all versions through 25.0. Because the endpoint performs real asymmetric cryptographic operations on attacker-supplied key material, server memory and logging subsystems (application logs, access logs, error logs) may capture the submitted private key depending on server configuration.

RemediationAI

No vendor-released patch has been identified at time of analysis - the composer package data records no fixed version for wwbn/avideo. Until a patched release is available, the most targeted compensating control is to block or restrict access to the specific endpoint /plugin/LoginControl/pgp/decryptMessage.json.php at the web server or WAF layer (e.g., nginx location deny or Apache RequireAll denied rules); this eliminates both attack vectors with no functional impact on users who do not rely on server-side PGP decryption. If the PGP decryption feature is unused, disabling the LoginControl plugin entirely is preferable and has no side effects for unrelated features. For deployments where the endpoint must remain accessible, restrict it to authenticated internal networks only via IP allowlist at the firewall or load balancer. Rate limiting (e.g., via nginx limit_req or a WAF rule) mitigates the CPU exhaustion vector but does not address the key material logging risk. Monitor the GitHub advisory at https://github.com/WWBN/AVideo/security/advisories/GHSA-5x2w-37xf-7962 for patch availability.