Executive brief
WWBN AVideo is an open-source platform used for hosting and managing video content. A security flaw allows registered users to configure donation notification settings that force the server to send requests to internal network locations or private cloud metadata services. This could allow an attacker to probe internal infrastructure or interact with sensitive internal services that are not intended to be accessible from the internet.
Technical details
A blind Server-Side Request Forgery (SSRF) exists in the YPTWallet plugin of WWBN AVideo. The vulnerability occurs because the `setDonationNotificationURL` function only performs basic format validation using `isValidURL()` instead of the more robust `isSSRFSafeURL()` helper, allowing the storage of internal or loopback addresses. When a donation is triggered via `donate.json.php`, the server executes a cURL POST request to the user-supplied URL. Furthermore, the cURL configuration has `CURLOPT_FOLLOWLOCATION` enabled without per-hop revalidation, allowing attackers to bypass initial URL filters via HTTP 307 redirects from an external server to internal targets. An attacker requires an authenticated account and a second account with a minimal wallet balance to trigger the request.
Affected products
- WWBN AVideo (formerly YouPHPTube) <= 29.0
Timeline
- 2026-04-27: advisory: Original GitHub Security Advisory published
- 2026-05-11: disclosed: CVE published to NVD
- 2026-05-11: patched: Fix committed in aaacd48f29f1ff71d1eb5fc81d37605f593cefa9