GHSA-QXVM-R42F-5P8J: Authentication Bypass via Meet Plugin in AVideo Vulnerability ID: GHSA-QXVM-R42F-5P8J CVSS Score: 9.8 Published: 2026-05-15 AVideo is vulnerable to a critical authentication bypass within the Meet plugin. An attacker possessing the Meet shared secret can impersonate any user, including administrators, by supplying a crafted filename to the video upload endpoint, leading to complete system compromise. TL;DR A flaw in AVideo's Meet plugin allows authentication bypass and arbitrary user impersonation. By exploiting an insecure passwordless login mechanism linked to video file uploads, an attacker can obtain administrative access.…