WWBN AVideo authorization bypass in Meet plugin

Executive brief

A vulnerability in the Meet plugin of AVideo, a video platform, allows an attacker to take over any user account, including administrators. By exploiting a flaw in how the system handles recorded video uploads, an attacker who knows a specific secret key can trick the server into logging them in as a different user. This could lead to full control over the video platform, unauthorized access to private data, and the ability to modify system configurations.

Technical details

The vulnerability exists in `plugin/Meet/uploadRecordedVideo.json.php`, which authenticates requests using a shared secret but then derives the `users_id` for the session from the `name` field of the uploaded multipart file. After parsing the ID, the application calls `$userObject->login(true, true)`, which invokes a passwordless login path that regenerates the session ID and returns a valid session cookie to the caller. An attacker with knowledge of the Meet shared secret (which can be computed if the system salt is leaked or recovered via a timing attack on `checkToken.json.php`) can impersonate any user, including the administrator (ID 1). This results in full account takeover and session hijacking.

Affected products

• WWBN AVideo <= 29.0

Timeline

• 2026-05-11: advisory: Initial disclosure on GitHub
• 2026-05-15: disclosed: Published date

References

• https://api.github.com/users/offset
• https://github.com/offset
• https://api.github.com/users/offset/gists%7B/gist_id%7D
• https://api.github.com/users/offset/repos
• https://avatars.githubusercontent.com/u/114768995?v=4
• https://api.github.com/users/offset/events%7B/privacy%7D