GHSA-xj9w-cgqg-q897

Source

https://github.com/advisories/GHSA-xj9w-cgqg-q897

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xj9w-cgqg-q897/GHSA-xj9w-cgqg-q897.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-xj9w-cgqg-q897

Withdrawn

2026-09-10T15:06:48Z

Published

2026-06-20T21:31:22Z

Modified

2026-09-10T15:15:04Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L CVSS Calculator
6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-5x2w-37xf-7962. This link is maintained to preserve external references.

Original Description

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.

Database specific

{
    "cwe_ids":  [
        "CWE-306"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-09-10T15:06:48Z",
    "nvd_published_at":  "2026-06-20T19:16:24Z",
    "severity":  "MODERATE"
}

References

Affected packages

Packagist / wwbn/avideo

Package

Name: wwbn/avideo
Purl: pkg:composer/wwbn/avideo

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

25.0

Affected versions

10.*

10.4

10.8

Other

11.*

11.1

11.1.1

11.5

11.6

12.*

12.4

14.*

14.3

14.3.1

14.4

18.*

18.0

21.*

21.0

22.*

22.0

24.*

24.0

25.*

25.0

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/06/GHSA-xj9w-cgqg-q897/GHSA-xj9w-cgqg-q897.json"