Is CVE-2026-56346 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56346 being exploited in the wild.

How severe is CVE-2026-56346?

Medium severity, with a CVSS score of 6.5, published 20 June 2026.

Which products and versions are affected?

wwbn/avideo (Packagist) <= 25.0, ECOSYSTEM:introduced=0,last_affected=25.0; WWBN AVideo <= 25.0.

Is there a fix for CVE-2026-56346?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56346 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56346?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56346: WWBN AVideo authentication bypass in decryptMessage.json.php

Q: Is there a fix for CVE-2026-56346?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-56346 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-56346?

Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56346 · Severity: medium · CVSS 6.5 · Published 2026-06-20

AVideo is a video platform that includes a cryptographic message decryption feature. An unauthenticated endpoint allows anyone on the network to submit encryption keys and encrypted messages for server-side decryption without logging in or providing any credentials. This exposes private keys to server logs and allows attackers to perform unlimited decryption operations, consuming server resources and potentially revealing sensitive key material to anyone with log access.

Technologies: wwbn/avideo (Packagist), WWBN AVideo. Vendors: Packagist, WWBN.

Quick answers

Is CVE-2026-56346 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56346 being exploited in the wild.
How severe is CVE-2026-56346?: Medium severity, with a CVSS score of 6.5, published 20 June 2026.
Which products and versions are affected?: wwbn/avideo (Packagist) <= 25.0, ECOSYSTEM:introduced=0,last_affected=25.0; WWBN AVideo <= 25.0.
Is there a fix for CVE-2026-56346?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56346 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56346?: Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a missing authentication check in the decryptMessage.json.php endpoint (CWE-306). The endpoint accepts a JSON POST request with three fields: textToDecrypt, privateKeyToDecryptMsg, and keyPassword. The server directly passes these to a decryption function without calling any session validation or User::isLogged() check. The attack vector is network-based with no privileges required, attack complexity is low, and no user interaction is needed. An unauthenticated attacker can invoke the endpoint to decrypt arbitrary ciphertexts using provided private keys, offloading cryptographic work to the target server. This results in low confidentiality impact (exposure of key material in logs) and low availability impact (CPU exhaustion via repeated requests). No rate limiting exists to constrain attack volume. As of the advisory date, no patched version is available.

Affected products

WWBN AVideo <= 25.0

Identifiers

CVE-2026-56346
GHSA-5x2w-37xf-7962

Timeline

2026-03-19: disclosed: Published to GitHub Advisory Database
2026-03-18: advisory: Published by WWBN/AVideo repository

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.