CVE-2025-34433 is an unauthenticated remote code execution vulnerability in AVideo caused by improper control of code generation (CWE-94). The vulnerability arises from the predictable generation of an installation salt using PHP uniqid(), combined with exposure of the installation timestamp and a derived hash via public endpoints. Attackers can brute-force the remaining entropy of the salt, then use it to encrypt a malicious payload sent to a notification API endpoint that evaluates attacker-controlled input, leading to arbitrary code execution with the privileges of the web server user. This affects AVideo versions 14.3.1 prior to 20.1.

Successful exploitation allows unauthenticated attackers to execute arbitrary code on the affected server as the web server user. This can lead to full compromise of the application environment, unauthorized access, data theft, or further attacks within the network. The vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with high impact on confidentiality, integrity, and availability.

No official patch or remediation is currently confirmed for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected API endpoints if possible and monitor for suspicious activity related to the notification API. Avoid exposing installation timestamps or derived hashes publicly. Consider applying application-level input validation and disabling evaluation of attacker-controlled input if feasible.