CVE-2026-56345
CRITICAL
INFO
Priority: 0.04
BB Relevance:
68/100
Published: 2026-06-20
Modified: 2026-11-08
First seen: 2026-11-08
Status: active
Attack Surface
Network
No Auth
No Interaction
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
None
UI:
None
AT:
Present
VC:
High
VI:
High
VA:
High
Description
AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filename like '1-anything.mp4' to hijack admin sessions and gain full account takeover.
Weakness Classification (1)
References & Advisories (2)
vendor-advisory
third-party-advisory