GHSA-QXVM-R42F-5P8J: Authentication Bypass via Meet Plugin in AVideo

Vulnerability ID: GHSA-QXVM-R42F-5P8J

CVSS Score: 9.8

Published: 2026-05-15

AVideo is vulnerable to a critical authentication bypass within the Meet plugin. An attacker possessing the Meet shared secret can impersonate any user, including administrators, by supplying a crafted filename to the video upload endpoint, leading to complete system compromise.

TL;DR

A flaw in AVideo's Meet plugin allows authentication bypass and arbitrary user impersonation. By exploiting an insecure passwordless login mechanism linked to video file uploads, an attacker can obtain administrative access.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-287 / CWE-288 / CWE-306

Attack Vector : Network

Authentication : Shared Secret Required

Impact : Administrative Privilege Escalation

Exploit Status : Proof of Concept

Vulnerable Component : uploadRecordedVideo.json.php

Affected Systems

AVideo (formerly YouPHPTube)

AVideo Meet Plugin

AVideo Meet…