Executive brief
WWBN AVideo is a video hosting and streaming platform. An unauthenticated server-side request forgery (SSRF) vulnerability in the login authentication function allows attackers to make the server fetch arbitrary files from the local filesystem or access internal services via HTTP requests. An attacker can exploit this to read sensitive local files or interact with internal services that should only be accessible from within the network.
Technical details
The vulnerability exists in the _json_decode() function, which calls file_get_contents() on any string that passes isValidURLOrPath() validation without performing SSRF-safe URL checks. The login.json.php endpoint accepts unauthenticated POST requests containing raw JSON input, passing it directly to _json_decode(). An attacker can POST a local filesystem path (e.g., /var/www/html/videos/malicious.json) or an HTTP URL (including loopback addresses like 127.0.0.1) to trigger the server to fetch and parse the resource as login credentials. This bypasses authentication entirely and allows reading local files or accessing internal HTTP services. The vulnerability is unpatched as of the advisory publication date.
Affected products
- WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-wqwf-wmvx-53jh published
- 2026-09-11: advisory: CVE-2026-89242 published