Executive brief
AVideo, an open-source video platform, contains a security flaw in its Meet plugin that allows an attacker to take over any user account, including administrators. By exploiting how the system handles recorded video uploads, an attacker can trick the platform into issuing them a valid login session without needing a password. This could lead to a total compromise of the video site, unauthorized access to private content, and full administrative control.
Technical details
An authorization bypass exists in the Meet plugin's uploadRecordedVideo.json.php endpoint due to improper identity verification. The endpoint authenticates requests using a shared secret but determines the target user identity (users_id) directly from the uploaded filename (e.g., '1-video.mp4') without further validation. After parsing the ID, the application calls a passwordless login method, User->login(true, true), which generates a valid session cookie for the specified user. An attacker who obtains the shared secret—either via existing path-traversal vulnerabilities or timing attacks against the checkToken.json.php endpoint—can craft a POST request to hijack any account, including the administrator (typically users_id 1). As of the advisory date, no patched version is specified for versions up to 29.0.
Affected products
- WWBN AVideo <= 29.0
Timeline
- 2026-05-11: advisory: Vendor-side advisory published on GitHub
- 2026-06-20: disclosed: NVD publication date