# CVE-2026-56345: WWBN AVideo authorization bypass in Meet plugin

Source: https://junglewise.ai/threats/cve-2026-56345-wwbn-avideo-authorization-bypass-in-meet-plugin  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-20. Updated: 2026-06-21  
License: CC BY 4.0 with a link back

CVE-2026-56345 · Severity: high · CVSS 8.1 · Published 2026-06-20

AVideo, an open-source video platform, contains a security flaw in its Meet plugin that allows an attacker to take over any user account, including administrators. By exploiting how the system handles recorded video uploads, an attacker can trick the platform into issuing them a valid login session without needing a password. This could lead to a total compromise of the video site, unauthorized access to private content, and full administrative control.

Technologies: [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo), [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-56345 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56345 being exploited in the wild.

**How severe is CVE-2026-56345?** High severity, with a CVSS score of 8.1, published 20 June 2026.

**Which products and versions are affected?** wwbn/avideo (Packagist) ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0.

**Is there a fix for CVE-2026-56345?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-56345 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-56345?** Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An authorization bypass exists in the Meet plugin's uploadRecordedVideo.json.php endpoint due to improper identity verification. The endpoint authenticates requests using a shared secret but determines the target user identity (users_id) directly from the uploaded filename (e.g., '1-video.mp4') without further validation. After parsing the ID, the application calls a passwordless login method, User->login(true, true), which generates a valid session cookie for the specified user. An attacker who obtains the shared secret—either via existing path-traversal vulnerabilities or timing attacks against the checkToken.json.php endpoint—can craft a POST request to hijack any account, including the administrator (typically users_id 1). As of the advisory date, no patched version is specified for versions up to 29.0.

## Affected products

- WWBN AVideo <= 29.0

## Identifiers

- CVE-2026-56345
- GHSA-qxvm-r42f-5p8j

## Timeline

- 2026-05-11: advisory: Vendor-side advisory published on GitHub
- 2026-06-20: disclosed: NVD publication date

## References

- [https://github.com/WWBN/AVideo/security/advisories/GHSA-qxvm-r42f-5p8j](https://github.com/WWBN/AVideo/security/advisories/GHSA-qxvm-r42f-5p8j)
- [https://www.vulncheck.com/advisories/avideo-arbitrary-user-session-hijacking-via-meet-plugin-uploadrecordedvideo-endpoint](https://www.vulncheck.com/advisories/avideo-arbitrary-user-session-hijacking-via-meet-plugin-uploadrecordedvideo-endpoint)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)