AVideo vulnerabilities
We track 2 vulnerabilities in AVideo products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on June 20, 2026.
2vulnerabilities
0critical
2high
0exploited
7.8average CVSS score
Latest AVideo vulnerabilities
- 8.1 High severity
AVideo: Improper Authentication
AVideo through 29.0 contains an authorization bypass vulnerability in the Meet plugin's uploadRecordedVideo.json.php endpoint that derives the target users_id from the uploaded filename without verification. An attacker with knowledge of the Meet shared secret
- 7.5 High severity
AVideo: Missing Authorization
AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attackers can retrieve all p