Executive Summary

CVE-2026-56346 is an authentication bypass vulnerability in the AVideo platform (up to version 25.0) affecting the decryptMessage.json.php endpoint.

This vulnerability allows unauthenticated users to submit private keys, ciphertext, and passphrases to the server and receive decrypted PGP messages without any authentication.

The endpoint processes these inputs without validating user sessions or credentials, which means anyone can perform server-side decryption.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to exposure of sensitive private key material in server logs, as the submitted keys and passphrases may be logged.

Additionally, attackers can perform resource exhaustion attacks by sending unlimited decryption requests, potentially degrading or denying service.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for requests to the unauthenticated endpoint decryptMessage.json.php that include private keys, ciphertext, and passphrases. Network or web server logs can be inspected for such suspicious POST requests to this endpoint.

Commands to detect exploitation attempts might include searching web server logs for access to decryptMessage.json.php, for example using grep:

• grep 'decryptMessage.json.php' /var/log/apache2/access.log
• grep 'decryptMessage.json.php' /var/log/nginx/access.log

Additionally, monitoring for unusual CPU usage or resource exhaustion on the server could indicate exploitation attempts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include adding authentication checks to the decryptMessage.json.php endpoint to restrict access only to authorized users.

Review and modify logging configurations to prevent sensitive private key material and passphrases from being recorded in server logs.

Limit or throttle requests to this endpoint to prevent resource exhaustion attacks.

If possible, update the AVideo platform to a version that patches this vulnerability.

Useful 0 Not Useful 0