PT-2026-41716 · Avideo · Avideo

Snailsploit · Published 2026-05-18 · Updated 2026-05-29 · CVE-2026-45620

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier

Description An issue exists in the open source video platform where the endpoint "objects/mention.json.php" lacks a User::loginCheck() or admin gate. The endpoint only implements an entry guard using preg match('/^@/', $ REQUEST['term']) and a hard-coded rowCount=10. This allows unauthenticated users to perform user enumeration by manipulating the term variable.

Recommendations Update AVideo to a version later than 29.0. As a temporary workaround, restrict access to the "objects/mention.json.php" endpoint to minimize the risk of user enumeration.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

CWE-204

Related Identifiers

CVE-2026-45620

GHSA-VPFX-PXQW-2W79

Affected Products

Avideo

References · 6

• https://github.com/WWBN/AVideo/security/advisories/GHSA-vpfx-pxqw-2w79 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-45620 · Security Note
• https://osv.dev/vulnerability/GHSA-vpfx-pxqw-2w79 · Vendor Advisory
• https://github.com/WWBN/AVideo · Note
• https://reddit.com/r/VulnMatter/comments/1tgqoye/resumen_diario_de_vulnerabilidades_18052026 · Reddit Post
• https://github.com/advisories/GHSA-6rvw-7p8v-mjfq · Note