CVE-2026-56345: AVideo Meet Plugin Authentication Bypass & Account Takeover

Technical summary

CVE-2026-56345 is an authorization bypass in AVideo's Meet plugin affecting versions through 29.0. The uploadRecordedVideo.json.php endpoint extracts a users_id value from the uploaded filename and passes it directly to a passwordless User->login() function without any authorization checks or validation. An attacker with the Meet shared secret can craft a POST request with a multipart file upload where the filename encodes an arbitrary users_id (e.g., '1-anything.mp4' for user ID 1). The endpoint then invokes login() with that ID, establishing an authenticated session under that user's identity. The Meet shared secret itself can be compromised via path-traversal vulnerabilities or timing-based attacks against checkToken.json.php, creating a two-stage attack chain. The vulnerability is classified as CWE-287 (Improper Authentication).

Business impact

This vulnerability enables complete account takeover of any AVideo user, most critically administrative accounts. An attacker gaining admin access can modify system configurations, access all stored videos and user data, inject malicious content, disable security controls, or pivot to connected infrastructure. For organizations using AVideo for video conferencing, training, or content management, compromise of an admin account represents a total loss of confidentiality, integrity, and availability. The exploitation requires only network access and knowledge of the Meet shared secret, making it a significant operational risk in any exposed AVideo instance.

Affected systems

All AVideo installations running version 29.0 or earlier with the Meet plugin enabled are affected. The Meet plugin is commonly deployed alongside AVideo for video conferencing features. Organizations should inventory all AVideo instances and check their version numbers. The vulnerability is not limited to specific configurations—any instance with the vulnerable endpoint exposed and the shared secret accessible is at risk.

Exploitability

Exploitation is feasible for attackers with intermediate technical capability and network access to the AVideo instance. The primary barrier is obtaining the Meet shared secret, which can be extracted through either known path-traversal bugs or timing attacks against checkToken.json.php—both are documented attack vectors. Once the secret is known, the actual bypass is trivial: a single HTTP POST request with a crafted filename. The CVSS score of 8.1 (HIGH) reflects that while some attack complexity exists (AC:H), the consequences are severe and no authentication is required from the attacker's perspective (PR:N, UI:N).

Remediation

Organizations must immediately upgrade to a patched version of AVideo beyond 29.0. Verify the specific patched version against the AVideo project's official advisories and release notes. Interim mitigations include: restricting network access to AVideo to trusted networks only, disabling the Meet plugin if not in use, rotating the Meet shared secret, and implementing Web Application Firewall rules to block requests to uploadRecordedVideo.json.php from untrusted sources. However, these are temporary measures and should not substitute for patching.

Patch guidance

1. Consult the official AVideo project repository or security advisories to identify the earliest patched version greater than 29.0. 2. Test the patch in a non-production environment, verifying that video upload and Meet plugin functionality remain intact. 3. Apply the patch to all affected production instances. 4. After patching, reset the Meet shared secret and audit recent authentication logs for unauthorized access. 5. Verify that uploadRecordedVideo.json.php now validates the users_id independently rather than deriving it from the filename.

Detection guidance

Monitor for suspicious POST requests to /uploadRecordedVideo.json.php or similar endpoints with unusual filename patterns or unexpected users_id values. Audit access logs for rapid user-switching or logins from unusual IPs to admin or high-privilege accounts. Check for anomalous file uploads to the Meet plugin directory. Alert on any successful authentication immediately following a POST to uploadRecordedVideo.json.php. Examine the Meet shared secret for recent changes or exposure (e.g., in logs, path-traversal scan results). Implement request logging that captures uploaded filenames and compare them against legitimate video naming conventions.

Why prioritize this

This vulnerability merits immediate remediation because it enables passwordless, unrestricted account takeover of any user in the system. The attack requires only two prerequisites (Meet shared secret knowledge and network access) and results in administrative compromise. The CVSS score of 8.1 and the absence of active exploitation in KEV (at time of analysis) suggest a brief window before weaponization. Organizations should treat this as critical and prioritize patching ahead of lower-severity issues.

Risk score, explained

The CVSS 3.1 score of 8.1 reflects: Attack Vector Network (AV:N)—remotely exploitable with no special network access; Attack Complexity High (AC:H)—requires obtaining the Meet shared secret, adding friction; Privileges Required None (PR:N)—the attacker needs no pre-existing access to the target; User Interaction None (UI:N)—no user action is required; Scope Unchanged (S:U)—impact is confined to the affected system; Confidentiality High (C:H), Integrity High (I:H), Availability High (A:H)—full compromise of system data and control. The HIGH severity reflects the combination of remote exploitability and severe impact, despite the moderate barrier of obtaining the shared secret.

Frequently asked questions