CVE-2026-56346: AVideo Authentication Bypass in Decryption Endpoint

Technical summary

CVE-2026-56346 is an authentication bypass in AVideo's decryptMessage.json.php endpoint (CVSS 3.1 score: 6.5, MEDIUM severity). The vulnerability stems from insufficient access controls (CWE-306: Missing Authentication for Critical Function) that permit unauthenticated POST requests to perform server-side PGP decryption operations. Attackers can supply arbitrary private keys, ciphertext, and passphrases to trigger decryption routines without prior credential validation. The flaw results in two material risks: confidentiality impact through exposure of key material in application logs and server memory, and availability impact through resource exhaustion via repeated decryption requests targeting computationally expensive cryptographic operations.

Business impact

Organizations deploying AVideo 25.0 and earlier face two operational risks. First, private cryptographic keys submitted by attackers during exploitation may be logged or cached in memory, creating forensic evidence of the attack and potentially compromising downstream encrypted communications. Second, an attacker can degrade service availability by repeatedly invoking the unprotected decryption endpoint, consuming CPU and memory without authentication rate-limiting. For media and content platforms relying on AVideo for secure message handling, this vulnerability undermines the integrity of encrypted communication channels and increases incident response complexity.

Affected systems

AVideo through version 25.0 is affected. The vulnerability is present in the decryptMessage.json.php endpoint. No vendor patch version numbers are provided in the source data; verify the latest AVideo release against the official vendor advisory to confirm patched versions. Organizations should audit their AVideo installations and document which versions are currently running.

Exploitability

Exploitability is straightforward and requires no special privileges or user interaction. The attack is network-accessible (AV:N), requires no special conditions (AC:L), and needs no authentication (PR:N). An attacker with basic HTTP client capabilities can craft requests to the decryptMessage.json.php endpoint. The lack of rate-limiting or authentication checks means attackers can perform reconnaissance, extract key material, or launch denial-of-service attacks with minimal effort. This vulnerability is not currently listed on the CISA Known Exploited Vulnerabilities (KEV) catalog, but the low barrier to exploitation suggests rapid adoption in attack tooling is likely.

Remediation

Immediate action is required. First, upgrade AVideo to a patched version released after 25.0; consult the official AVideo vendor advisory for specific version numbers. Second, apply temporary compensating controls: restrict network access to the decryptMessage.json.php endpoint at the firewall or reverse proxy layer, allowing requests only from trusted internal hosts. Third, implement API-level authentication checks or require valid session tokens before decryption operations are processed. Fourth, review application and system logs for signs of suspicious POST requests to decryptMessage.json.php, particularly those containing private keys or unusual ciphertext payloads.

Patch guidance

Upgrade AVideo to a version released after 25.0. Verify the exact patched version number against the official AVideo security advisory. During the upgrade, test decryptMessage.json.php endpoints to ensure they now enforce authentication and reject unauthenticated requests with a 401 or 403 response. If immediate patching is not possible, layer in firewall or WAF rules to block public access to the vulnerable endpoint until patching is complete.

Detection guidance

Monitor web server and application logs for POST requests to decryptMessage.json.php that originate from unauthenticated sessions or lack valid authorization headers. Flag requests containing base64-encoded or ASCII-armored PGP blocks (-----BEGIN PGP PRIVATE KEY BLOCK-----). Search logs for HTTP 200 responses to decryptMessage.json.php from external IP ranges. Implement SIEM alerts for a spike in requests to this endpoint, which may indicate a resource exhaustion attack. Review access logs for failed authentication attempts followed by successful decryption requests, suggesting an attacker testing the vulnerability.

Why prioritize this

Although the CVSS score is MEDIUM (6.5), this vulnerability warrants urgent prioritization because authentication bypass flaws are inherently dangerous and affect core security assumptions. The ease of exploitation (no special conditions, no authentication required) combined with exposure of cryptographic key material creates material risk to confidentiality and availability. Organizations handling sensitive communications should treat this as high priority regardless of CVSS score.

Risk score, explained

CVSS 3.1 score of 6.5 (MEDIUM) reflects moderate confidentiality impact (L) and availability impact (L) with no integrity impact. The score assumes local or network proximity and does not fully weight the operational severity of key material exposure or the reputational damage from demonstrable authentication bypass. Security teams should consider raising their internal risk rating above the base CVSS score because: (1) key material exposure has cascading effects on downstream systems, (2) authentication bypass is a known high-risk attack pattern, and (3) the endpoint targets cryptographic operations, which are sensitive by design.

Frequently asked questions