VULNERABILITY INTELLIGENCE
CVE-2026-56346
CVSS score6.5 MEDIUM
EPSS probability0.61%
CISA KEVNot currently listed
Published2026-06-20
Last modified2026-07-08
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Description
AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.
Weakness classification
- disclosure@vulncheck.com: CWE-306