# AVideo unauthenticated PGP message decryption in decryptMessage endpoint

Source: https://junglewise.ai/threats/avideo-unauthenticated-pgp-message-decryption-in-decryptmessage-ed490c51  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

Severity: medium · CVSS 6.5 · Published 2026-06-20

AVideo is a web-based video platform that includes encrypted messaging features. The application exposes a public decryption endpoint that fails to require authentication, allowing anyone on the internet to submit encrypted messages along with private keys and passwords for decryption. Attackers can exploit this to extract sensitive cryptographic key material into server logs, consume server CPU resources without restriction, and potentially decrypt communications they should not have access to.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo), [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Medium severity, with a CVSS score of 6.5, published 20 June 2026.

**Which products and versions are affected?** wwbn/avideo (Packagist) <= 25.0; WWBN AVideo <= 25.0.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a web application.

**Am I affected?** Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a missing authentication check (CWE-306) in the decryptMessage.json.php endpoint. The endpoint accepts JSON-formatted requests containing three user-supplied fields: a private key block, ciphertext, and key passphrase. The server directly invokes the decryptMessage() function on this data without calling any authentication or session validation routine (e.g., User::isLogged()). Since the endpoint is publicly accessible and performs no access control checks, any unauthenticated request is processed. The attack vector is network-based with low complexity: an attacker submits a POST request with JSON body containing the three fields and receives decrypted plaintext in the response. Primary impacts include: (1) private key material processed in server memory and potentially captured in application, web server, or error logs; and (2) unconstrained CPU consumption for cryptographic operations on behalf of unauthenticated users. No patch is currently available for affected versions &lt;= 25.0.

## Affected products

- WWBN AVideo <= 25.0

## Timeline

- 2026-06-20: disclosed
- 2026-06-20: advisory: GHSA-5x2w-37xf-7962 published
- 2026-09-10: other: GHSA-xj9w-cgqg-q897 marked as duplicate and withdrawn

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-5x2w-37xf-7962](https://github.com/WWBN/AVideo/security/advisories/GHSA-5x2w-37xf-7962)
- [https://www.vulncheck.com/advisories/avideo-unauthenticated-pgp-message-decryption-via-decryptmessage-json-php-endpoint](https://www.vulncheck.com/advisories/avideo-unauthenticated-pgp-message-decryption-via-decryptmessage-json-php-endpoint)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)