Cloudanix VulnDB

GHSA-5x2w-37xf-7962

Medium · 6.5

AVideo has Unauthenticated PGP Message Decryption via Public Endpoint

CVSS

6.5

EPSS

—

Published

Mar 19, 2026

CISA due date

—

The record

The AVideo platform exposes a publicly accessible endpoint that performs server-side PGP decryption without requiring any form of authentication. Any anonymous user can submit a private key, ciphertext, and passphrase to the endpoint and receive the decrypted plaintext in the JSON response. This functionality is entirely unprotected, meaning no session, token, or credential is needed to invoke it.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities