{"id":"GHSA-mwjc-5j4x-r686","aliases":["CVE-2026-33512"],"title":"AVideo has an unauthenticated decrypt oracle leaking any ciphertext","description":"### Summary\nThe API plugin exposes a `decryptString` action without any authentication. Anyone can submit ciphertext and receive plaintext. Ciphertext is issued publicly (e.g., `view/url2Embed.json.php`), so any user can recover protected tokens/metadata. Severity: High.\n\n### Details\n- Entry: `plugin/API/get.json.php` is unauthenticated.\n- Handler: `plugin/API/API.php` `get_api_decryptString()` (lines ~5945–5966):\n  ```php\n  $string = decryptString($_REQUEST['string']);\n  return new ApiObject($string, empty($string));\n  ```\n  No APISecret or user check occurs before decrypting.\n- Public ciphertext source: `view/url2Embed.json.php` returns `playLink`/`playEmbedLink` (`encryptString(json_encode(...))`) to any caller.\n\n### PoC\n1. Obtain ciphertext:\n   ```\n   GET /view/url2Embed.json.php?url=https://example.com/video.mp4\n   ```\n   Copy `playLink`.\n2. Decrypt without auth:\n   ```\n   POST /plugin/API/get.json.php?APIName=decryptString\n   Content-Type: application/x-www-form-urlencoded\n\n   string=<playLink ciphertext>\n   ```\n   Response contains the plaintext JSON (videoLink, title, users_id, etc.).\n\n### Impact\n- Any encrypted payload produced by the platform can be decrypted by anyone.\n- Leaks tokens/links intended to be confidential; enables replay and tampering where secrecy was assumed.\n\n### Mitigation\n- Require API secret or authenticated/authorized user for `decryptString`, or remove the endpoint.\n- Prefer one-way signatures (HMAC) instead of exposing generic decryption.\n- Rotate encryption keys/salts after patch to invalidate exposed ciphertexts.","severity":"high","score":7.5,"published":"2026-03-20T21:55:12.000Z","modified":"2026-03-25T14:56:26.493Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"Packagist","name":"wwbn/avideo","ranges":[{"events":[{"introduced":"0"},{"last_affected":"26.0"}],"type":"ECOSYSTEM"}],"versions":["10.4","10.8","11","11.1","11.1.1","11.5","11.6","12.4","14.3","14.3.1","14.4","18.0","21.0","22.0","24.0","25.0","26.0"],"fixed":[]}],"references":["https://github.com/WWBN/AVideo/security/advisories/GHSA-mwjc-5j4x-r686","https://nvd.nist.gov/vuln/detail/CVE-2026-33512","https://github.com/WWBN/AVideo/commit/3fdeecef37bb88967a02ccc9b9acc8da95de1c13","https://github.com/WWBN/AVideo"],"sources":[{"name":"OSV","id":"GHSA-mwjc-5j4x-r686","modified":"2026-03-25T14:56:26.493950Z","url":"https://osv.dev/vulnerability/GHSA-mwjc-5j4x-r686"}],"assessments":[{"source":"OSV","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","score":7.5}]}