CVE-2026-56345 Details

An authorization bypass vulnerability has been identified in AVideo versions through 29.0, specifically within the Meet plugin's uploadRecordedVideo.json.php endpoint. This vulnerability arises because the endpoint derives the target user ID from the uploaded filename without proper verification. An attacker who knows the Meet shared secret can craft a malicious file upload with a filename that includes an arbitrary user ID, bypassing authentication to invoke a passwordless login for that user. This exploitation establishes an authenticated session, potentially allowing the attacker to impersonate any user, including an admin. The Meet shared secret can be obtained through path-traversal vulnerabilities or timing attacks against checkToken.json.php.

Users are advised to update to the patched version of AVideo, which includes a verification step for the user ID claim in the upload process, preventing unauthorized session establishment.