Security Advisory - Published 2026-06-22 - AVideo
AVideo CVE batch: check Meet, payment plugins, users, and logs
This batch affects AVideo installs that expose payment plugins, the Meet plugin, message handling, or Live plugin features. Patch first. Then review user sessions, recorded-video uploads, payment records, outbound requests, and server logs around the disclosure window.
Affected AVideo items
| CVE | Affected | Review | CVSS |
|---|---|---|---|
| CVE-2026-56345 | through 29.0 | Meet plugin settings, recorded-video uploads, user sessions, and admin logins | 9.2 |
| CVE-2026-56341 | through 26.0 | payment plugin logs, PayPal or Authorize.Net records, and Bitcoin transaction records | 8.7 |
| CVE-2026-56346 | through 25.0 | message plugin usage, server logs, and unusual resource spikes | 6.9 |
| CVE-2026-56342 | through 27.0 | Live plugin settings, outbound requests, and admin activity | 6.8 |
Owner self-check
grep -Rni 'AVideo\\|Meet\\|PayPal\\|Authorize\\|Bitcoin\\|PGP\\|Live' . --include='*.php' --include='*.json' --include='*.log'
find . -type f -mtime -10 | egrep '\\.php$|\\.phtml$|\\.phar$|\\.zip$|\\.sql$|\\.mp4$|\\.log$'
find videos cache objects tmp upload -type f -mtime -10 2>/dev/null
grep -Rni 'login\\|session\\|payment\\|upload\\|error\\|warning' videos logs storage 2>/dev/nullWhat to review
- Unexpected admin or user sessions, changed passwords, and new users.
- Recorded-video uploads, recent media files, and files written outside normal media paths.
- Payment plugin logs, gateway tokens, webhook records, and transaction exports.
- Outbound requests from the server and access to internal services during the exposure window.
- Message plugin use and resource spikes tied to unauthenticated requests.
Safe fix path
- Upgrade AVideo to a fixed release or disable exposed plugins until the vendor fix is installed.
- Preserve web, PHP, AVideo, payment, and system logs before cleanup.
- Rotate admin, database, payment gateway, webhook, and API credentials if suspicious access is found.
- Review file ownership and remove unexpected PHP files before bringing the site back to normal traffic.
Repair help
Use Ping7 CVE Repair when AVideo had public plugins enabled, payment logs were exposed, users changed, or upload paths contain files that are hard to explain.