Executive brief
WWBN AVideo is an open-source video streaming and sharing platform. A security flaw in the live restreaming feature allows users with streaming permissions to trick the server into making unauthorized requests to internal systems. This could allow an attacker to access private internal data, administrative panels, or other services that are not supposed to be reachable from the internet.
Technical details
A stored Server-Side Request Forgery (SSRF) vulnerability exists in WWBN AVideo versions 26.0 and prior within the Live restream log callback flow. The vulnerability is rooted in the `plugin/Live/view/Live_restreams_logs/add.json.php` component, which accepts an attacker-controlled `restreamerURL` without sufficient validation. An authenticated user with streaming privileges can store a malicious URL (such as a loopback address or internal IP) and subsequently trigger the server to fetch it via `getRestream.json.php`. This allows the attacker to proxy requests to internal-only HTTP services and view the responses. The maintainer has indicated that a fix involves validating the `restreamerURL` against trusted endpoints at storage time and re-validating before use.
Affected products
- WWBN AVideo <= 26.0
Timeline
- 2026-04-06: advisory: GitHub Security Advisory published
- 2026-04-07: disclosed: CVE published to NVD