WWBN AVideo: Six Vulnerabilities Including SSRF Bypass and Credential Exposure Disclosed Together
WWBN AVideo platform hit with six vulnerabilities on August 30, 2026, including critical SSRF bypass and stream credential exposure flaws.
Key findings
- Six vulnerabilities in WWBN AVideo disclosed on August 30, 2026, including SSRF bypass and credential exposure.
- High-severity flaws include CVE-2026-82648 (SSRF bypass) and CVE-2026-82645 (stream credential exposure).
- Medium-severity issues include CSRF, reflected XSS, and rate-limiting bypass vulnerabilities.
- Vulnerabilities affect endpoints related to URL handling, email sending, stream keys, and authentication.
- All issues are addressed in commit e01e41ecc and later; users should update promptly.
On August 30, 2026, WWBN disclosed six vulnerabilities affecting its AVideo platform. The batch includes a mix of high and medium severity flaws, with the most critical being a server-side request forgery (SSRF) bypass and an information disclosure vulnerability. These vulnerabilities, disclosed on the same day, highlight potential security weaknesses in how AVideo handles user input and manages access controls.
One of the high-severity flaws, CVE-2026-82648, is an SSRF filter bypass in the isSSRFSafeURL function. This vulnerability specifically targets the failure to normalize hexadecimal-encoded NAT64 addresses, allowing attackers to potentially reach cloud metadata services or internal network resources by bypassing existing SSRF protections.
Another high-severity issue, CVE-2026-82645, involves the exposure of stream credentials through the getLiveKey.json.php endpoint. By providing a 'token' parameter, attackers can bypass access gates and ownership checks, gaining access to any restream's stream credentials. This could lead to unauthorized access and control over live streaming content.
A third high-severity vulnerability, CVE-2026-82644, is a brute-force rate limiting bypass. The enforceRateLimit() function, which protects multiple endpoints including login.json.php, fails to properly enforce rate limits for clients identified as bots due to how its attempt counter is managed in the cache layer. This could enable attackers to perform brute-force attacks more effectively.
The batch also includes medium-severity vulnerabilities. CVE-2026-82647 is a cross-site request forgery (CSRF) vulnerability in sendEmail.json.php, allowing authenticated administrators to send emails from the site's contact address by bypassing origin checks and CAPTCHA validation. Additionally, CVE-2026-82643 is an unauthenticated credential submission vulnerability in preauthorize.json.php, which accepts credentials over GET without rate limiting, potentially leading to sustained password guessing attacks and uncapped two-factor confirmation emails.
Finally, CVE-2026-82646 is an unauthenticated reflected cross-site scripting (XSS) vulnerability in the url2Embed.json.php endpoint. Attackers can inject malicious scripts by supplying URLs with HTML metacharacters, potentially leading to script execution in the context of other users.
All disclosed vulnerabilities appear to be addressed in commit e01e41ecc and later. Users are strongly advised to update to the latest version to mitigate these security risks. The coordinated disclosure of these six CVEs underscores the importance of regular security audits and timely patching for AVideo users.