Executive brief
AVideo is a video hosting and streaming platform used by organizations to manage and distribute video content. An authenticated attacker can exploit a Server-Side Request Forgery (SSRF) vulnerability in the encoder API to make the server fetch arbitrary URLs, potentially exposing internal services, APIs, and sensitive metadata that could lead to further compromise or data theft.
Technical details
The aVideoEncoder.json.php API endpoint in AVideo versions ≤21.0 fails to validate or restrict the downloadURL parameter, allowing it to fetch resources from attacker-specified URLs without an allow-list. The vulnerability requires authentication (low privilege level) and network access to the affected instance. An authenticated attacker can leverage this SSRF to probe internal network services, access metadata services, retrieve data from internal APIs, or further compromise the deployment depending on network segmentation. The vulnerability affects confidentiality and integrity of the system. The fix is available in AVideo version 22.0 and later.
Affected products
- WWBN AVideo <= 21.0
Timeline
- 2026-02-23: disclosed: Vulnerability disclosed by GitHub Advisory
- 2026-02-23: patched: Fixed in AVideo version 22.0
- 2026-02-25: advisory: GitHub Advisory GHSA-h39h-7cvg-q7j6 published
- 2026-02-24: other: NVD entry CVE-2026-27732 published