https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 18:27:00 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-56346 <p>AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.</p> <p>AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-56346 https://vulnerability.circl.lu/vuln/ghsa-5x2w-37xf-7962 <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>The AVideo platform exposes a publicly accessible endpoint that performs server-side PGP decryption without requiring any form of authentication. Any anonymous user can submit a private key, ciphertext, and passphrase to the endpoint and receive the decrypted plaintext in the JSON response. This functionality is entirely unprotected, meaning no session, token, or credential is needed to invoke it.</p> <p>### Details</p> <p>The endpoint at decryptMessage.json.php accepts a JSON body containing three user-supplied fields: a private key, an encrypted message, and a key password. The server passes these directly into a decryption routine and returns the result. There is no call to any authentication or session validation function before this operation is performed. The relevant server-side operation is:</p> <p>```php $textDecrypted = decryptMessage($obj-&gt;textToDecrypt, $obj-&gt;privateKeyToDecryptMsg, $obj-&gt;keyPassword); ```</p> <p>Because no access control exists, any unauthenticated request that reaches this endpoint will be processed. The primary concerns are exposure of private key material to server memory and logging infrastructure, and unconstrained consumption of server CPU resources for cryptographic operations. An attacker who has obtained a private key and matching ciphertext through other means can offload decryption work to the target server without holding any account on the platform.</p> <p>### PoC</p> <p>```sh curl -s -X POST \ &#34;https://target.example.com/plugin/LoginControl/pgp/decrypt…</p> <p><strong>Affected:</strong> Packagist: wwbn/avideo</p> <p>### Summary</p> <p>The AVideo platform exposes a publicly accessible endpoint that performs server-side PGP decryption without requiring any form of authentication. Any anonymous user can submit a private key, ciphertext, and passphrase to the endpoint and receive the decrypted plaintext in the JSON response. This functionality is entirely unprotected, meaning no session, token, or credential is needed to invoke it.</p> <p>### Details</p> <p>The endpoint at decryptMessage.json.php accepts a JSON body containing three user-supplied fields: a private key, an encrypted message, and a key password. The server passes these directly into a decryption routine and returns the result. There is no call to any authentication or session validation function before this operation is performed. The relevant server-side operation is:</p> <p>```php $textDecrypted = decryptMessage($obj-&gt;textToDecrypt, $obj-&gt;privateKeyToDecryptMsg, $obj-&gt;keyPassword); ```</p> <p>Because no access control exists, any unauthenticated request that reaches this endpoint will be processed. The primary concerns are exposure of private key material to server memory and logging infrastructure, and unconstrained consumption of server CPU resources for cryptographic operations. An attacker who has obtained a private key and matching ciphertext through other means can offload decryption work to the target server without holding any account on the platform.</p> <p>### PoC</p> <p>```sh curl -s -X POST \ &#34;https://target.example.com/plugin/LoginControl/pgp/decrypt…</p> https://vulnerability.circl.lu/vuln/ghsa-5x2w-37xf-7962