Executive brief
AVideo is a web-based video platform that includes encrypted messaging features. The application exposes a public decryption endpoint that fails to require authentication, allowing anyone on the internet to submit encrypted messages along with private keys and passwords for decryption. Attackers can exploit this to extract sensitive cryptographic key material into server logs, consume server CPU resources without restriction, and potentially decrypt communications they should not have access to.
Technical details
The vulnerability is a missing authentication check (CWE-306) in the decryptMessage.json.php endpoint. The endpoint accepts JSON-formatted requests containing three user-supplied fields: a private key block, ciphertext, and key passphrase. The server directly invokes the decryptMessage() function on this data without calling any authentication or session validation routine (e.g., User::isLogged()). Since the endpoint is publicly accessible and performs no access control checks, any unauthenticated request is processed. The attack vector is network-based with low complexity: an attacker submits a POST request with JSON body containing the three fields and receives decrypted plaintext in the response. Primary impacts include: (1) private key material processed in server memory and potentially captured in application, web server, or error logs; and (2) unconstrained CPU consumption for cryptographic operations on behalf of unauthenticated users. No patch is currently available for affected versions <= 25.0.
Affected products
- WWBN AVideo <= 25.0
Timeline
- 2026-06-20: disclosed
- 2026-06-20: advisory: GHSA-5x2w-37xf-7962 published
- 2026-09-10: other: GHSA-xj9w-cgqg-q897 marked as duplicate and withdrawn