Answer in brief
CVE-2026-56345 records a Critical severity (CVSS 9.2) vulnerability in AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint. The current sources do not mark it as known exploited. The current feed maps AVideo/AVideo (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps AVideo/AVideo (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| AVideo/AVideogeneric | >=0 <=29.0 | Not reported |
Published upstream
Jun 20, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 20, 2026
AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret can craft a malicious file upload with a filename containing an arbitrary users_id to invoke passwordless User->login() and establish an authenticated session as any user including admin. Attackers can obtain the Meet shared secret through path-traversal vulnerabilities or timing attacks against checkToken.json.php, then POST a crafted file to uploadRecordedVideo.json.php with a filename like '1-anything.mp4' to hijack admin sessions and gain full account takeover.
Quoted source text, attributed separately from HOL analysis.