CVE-2026-56346 AVideo - Unauthenticated PGP Message Decryption via decryptMessage.json.php Endpoint
Unauthenticated attackers can decrypt PGP messages via an exposed endpoint, exposing key material and causing resource exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-56346?
CVE-2026-56346 is a medium-severity authentication bypass vulnerability in AVideo, published on 20 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.
Weakness: CWE-306
Which versions are affected by CVE-2026-56346?
2 open source packages ship an affected version, including wwbn/avideo.
| Package | Affected | Fixed in |
|---|---|---|
wwbn/avideo Packagist | All versions to 25.0 | None |
wwbn/avideo Packagist | All versions to 25.0 | None |
How do I fix CVE-2026-56346?
No fix has been published for CVE-2026-56346 yet. Limit exposure of the affected software until one is available.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-56346 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56346 exists.
Sources
Also known as GHSA-5x2w-37xf-7962.