PT-2026-51175 · Avideo · Avideo

Offset · Published 2026-06-20 · Updated 2026-06-20 · CVE-2026-56345

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0

Description An authorization bypass exists in the Meet plugin's 'uploadRecordedVideo.json.php' endpoint. The system derives the target users id from the uploaded filename without proper verification. An attacker who possesses the Meet shared secret can upload a crafted file with a filename containing an arbitrary users id to trigger the login() function of the User class, establishing an authenticated session as any user, including the administrator. The Meet shared secret can be obtained via path-traversal vulnerabilities or timing attacks against the 'checkToken.json.php' endpoint. By sending a POST request to 'uploadRecordedVideo.json.php' with a filename such as '1-anything.mp4', an attacker can hijack administrative sessions and achieve full account takeover.

Recommendations Update to a version later than 29.0. As a temporary mitigation, restrict access to the 'uploadRecordedVideo.json.php' and 'checkToken.json.php' endpoints.

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-56345

Affected Products

Avideo

References · 6

• https://github.com/WWBN/AVideo/security/advisories/GHSA-qxvm-r42f-5p8j · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-56345 · Security Note
• https://twitter.com/infoflowcloud/status/2068467917251878975 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2068467520021856276 · Twitter Post
• https://vulncheck.com/advisories/avideo-arbitrary-user-session-hijacking-via-meet-plugin-uploadrecordedvideo-endpoint · Note
• https://twitter.com/CVEnew/status/2068466528643625279 · Twitter Post