Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56345AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint

High 8.1

In plain English

A high-severity improper authentication in AVideo from AVideo. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).

Severity (CVSS 3.1)8.1High

Exploit odds (30 days)0.5%top 60.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filename like '1-anything.mp4' to hijack admin sessions and gain full account takeover.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-qxvm-r42f-5p8j

Affected products (as reported)

Vendor	Product	Versions
AVideo	AVideo	0 – through 29.0

Weakness: CWE-287 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References

GHSA Advisory GHSA-qxvm-r42f-5p8j vendor-advisory
VulnCheck Advisory: AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint third-party-advisory