CVE-2026-56346 Details

An authentication bypass vulnerability has been identified in AVideo versions through 25.0, specifically in the decryptMessage.json.php endpoint. This vulnerability allows unauthenticated users to perform server-side decryption of PGP messages by submitting private keys, ciphertext, and passphrases. The absence of authentication means that any anonymous user can access this functionality, potentially exposing sensitive key material to application and web server logs. Additionally, the vulnerability could be exploited to conduct resource exhaustion attacks by overwhelming the server with decryption requests.

It is recommended to implement authentication checks for the decryptMessage.json.php endpoint to ensure that only logged-in users can access the decryption functionality. Additionally, review server logging configurations to prevent key material from being recorded in persistent logs.