CVE-2026-56346

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 25.1

Description An authentication bypass exists in the 'decryptMessage.json.php' endpoint, allowing unauthenticated users to decrypt PGP (Pretty Good Privacy) messages. Remote attackers can provide private keys, ciphertext, and passphrases to execute server-side decryption without credentials. This process can expose key material to logs and facilitate resource exhaustion attacks, where the server's resources are consumed to the point of unavailability.

Recommendations Update to a version later than 25.0. As a temporary workaround, restrict access to the 'decryptMessage.json.php' endpoint to minimize the risk of exploitation.