CVE-2026-56345: AVideo - Arbitrary User Session Hijacking via Meet Plugin uploadRecordedVideo Endpoint

Synopsis

An authorization bypass vulnerability in the AVideo Meet plugin's uploadRecordedVideo.json.php endpoint allows a remote, unauthenticated attacker to hijack any user account, including administrator accounts. The endpoint derives a target user identity from an uploaded filename with no cryptographic verification of that identity, so an attacker who possesses the Meet shared secret can craft a filename like '1-anything.mp4' to trigger a passwordless login as any user. Successful exploitation gives the attacker a fully authenticated session, enabling complete account takeover. HarborGuard is tracking this advisory for patch availability, as no fix version has been published upstream.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable endpoint is exposed over the network, so an attacker must be able to reach the AVideo service via HTTP/HTTPS.

• AuthenticationNot required

  No valid account or session token is needed; the attacker only needs the Meet shared secret, which can be obtained through separate path-traversal or timing-attack techniques against the same application.

• Victim interactionNot required

  Exploitation is fully server-side; no victim needs to click a link or take any action for the attacker to hijack a session.

• Attack complexityDetail

  Exploitation involves non-trivial preconditions, specifically obtaining the Meet shared secret through a separate path-traversal or timing attack, making reliable exploitation conditional on those environmental factors.

Blast Radius

• Reads all data accessible to the hijacked account, including stored session tokens, private video content, and any admin-visible user records.
• Modifies account settings, user roles, and application configuration as the hijacked admin user.
• Crashes or disrupts service availability by abusing admin-level controls over the AVideo platform.
• Pivots to further compromise by using admin credentials to install plugins or alter upload paths within the application.