Authentication Bypass in AVideo via PGP Decryption Endpoint

Executive Summary

CVE-2026-56346 is an authentication bypass vulnerability in the AVideo platform (up to version 25.0) affecting the decryptMessage.json.php endpoint.

This vulnerability allows unauthenticated users to submit private keys, ciphertext, and passphrases to the server and receive decrypted PGP messages without any authentication.

The endpoint processes these inputs without validating user sessions or credentials, which means anyone can perform server-side decryption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to exposure of sensitive private key material in server logs, as the submitted keys and passphrases may be logged.

Additionally, attackers can perform resource exhaustion attacks by sending unlimited decryption requests, potentially degrading or denying service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for requests to the unauthenticated endpoint decryptMessage.json.php that include private keys, ciphertext, and passphrases. Network or web server logs can be inspected for such suspicious POST requests to this endpoint.

Commands to detect exploitation attempts might include searching web server logs for access to decryptMessage.json.php, for example using grep:

• grep 'decryptMessage.json.php' /var/log/apache2/access.log
• grep 'decryptMessage.json.php' /var/log/nginx/access.log

Additionally, monitoring for unusual CPU usage or resource exhaustion on the server could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include adding authentication checks to the decryptMessage.json.php endpoint to restrict access only to authorized users.

Review and modify logging configurations to prevent sensitive private key material and passphrases from being recorded in server logs.

Limit or throttle requests to this endpoint to prevent resource exhaustion attacks.

If possible, update the AVideo platform to a version that patches this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated users to submit private keys, ciphertext, and passphrases to a server endpoint, resulting in server-side decryption without credentials. This can lead to exposure of sensitive key material in server logs.

Exposure of sensitive cryptographic material and potential unauthorized access to decrypted data could violate data protection requirements under regulations such as GDPR and HIPAA, which mandate protection of personal and sensitive information.

Additionally, the vulnerability enables resource exhaustion attacks, which could impact system availability, another important aspect of compliance frameworks.

Mitigation steps include adding authentication checks, restricting decryption to authorized users, and reviewing logging configurations to prevent sensitive data exposure, which are necessary to maintain compliance.

Useful 0 Not Useful 0