Authentication Bypass in AVideo by WWBN

CVE-2026-56346

What is CVE-2026-56346?

The AVideo platform prior to version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint. This flaw enables unauthenticated users to decrypt PGP messages by submitting private keys, ciphertext, and passphrases directly to the server. As a result, remote attackers can exploit this vulnerability to execute server-side decryption without the need for credentials. This not only exposes sensitive key material potentially logged by the server but also makes the system vulnerable to resource exhaustion attacks, jeopardizing user data integrity and server performance.

References