Executive brief
AVideo, an open-source video broadcasting platform, contains a security flaw in how its video encoder handles file downloads from external links. An authorized user can provide a specially crafted link that tricks the server into making requests to internal company systems or private cloud services that should not be accessible from the internet. This could allow an attacker to scan internal networks, interact with private services, or potentially access sensitive internal data.
Technical details
A Server-Side Request Forgery (SSRF) exists in AVideo's encoder component within the `downloadVideoFromDownloadURL` function. While the application implements SSRF hardening via `ssrfPinnedFetchToFile`, it includes a fallback mechanism that retries the fetch without DNS pinning if the initial pinned attempt fails. An authenticated attacker can exploit this by providing a `downloadURL` that redirects to an internal IP address; the initial pinned request fails the validation, but the subsequent unpinned retry follows the redirect without re-validating the target. This allows for blind SSRF against internal targets, including internal network scanning and access to cloud metadata services. The vulnerability is an incomplete fix for previous SSRF issues (CVE-2026-39370).
Affected products
- WWBN AVideo From commit 0dbadbca through latest master
Timeline
- 2026-07-07: advisory: GHSA-fr98-mjq9-7jmj published
- 2026-07-20: disclosed: NVD publication date