Junglewise Threat Intelligence

CVE-2026-27732: AVideo authenticated SSRF in aVideoEncoder.json.php

CVE-2026-27732 · Severity: high · CVSS 8.1 · Published 2026-02-25

Technologies: WWBN AVideo, wwbn/avideo (Packagist). Vendors: WWBN, Packagist.

Executive brief

AVideo is a video hosting and streaming platform used by organizations to manage and distribute video content. An authenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability in the encoder API to make the server fetch arbitrary URLs, potentially exposing internal services, APIs, and sensitive metadata that could lead to further compromise or data theft.

Technical details

The aVideoEncoder.json.php API endpoint in AVideo versions ≤21.0 fails to validate or restrict the downloadURL parameter, allowing it to fetch resources from attacker-specified URLs without an allow-list. The vulnerability requires authentication (low privilege level) and network access to the affected instance. An authenticated attacker can leverage this SSRF to probe internal network services, access metadata services, retrieve data from internal APIs, or further compromise the deployment depending on network segmentation. The vulnerability affects confidentiality and integrity of the system. The fix is available in AVideo version 22.0 and later.

Affected products

  • WWBN AVideo <= 21.0

Timeline

  • 2026-02-23: disclosed: Vulnerability disclosed by GitHub Advisory
  • 2026-02-23: patched: Fixed in AVideo version 22.0
  • 2026-02-25: advisory: GitHub Advisory GHSA-h39h-7cvg-q7j6 published
  • 2026-02-24: other: NVD entry CVE-2026-27732 published

References

Related threats