VYPR
Vypr IntelligenceAI-generatedSep 16, 2026· 13 CVEs

WWBN AVideo: Twelve Vulnerabilities Disclosed, Including Auth Bypass and SSRF

WWBN AVideo platform hit with twelve disclosed vulnerabilities, including high-severity flaws in access control, authentication, and SSRF, affecting version 29.0 and earlier.

Key findings

  • Twelve vulnerabilities disclosed for WWBN AVideo v29.0 and earlier, impacting security and access control.
  • High-severity flaws include authentication bypass (CVE-2026-92578), CSRF (CVE-2026-92582), and information disclosure with stream key exposure (CVE-2026-91965).
  • Multiple SSRF vulnerabilities (CVE-2026-91967, CVE-2026-91966) allow network probing and external request execution.
  • Access control weaknesses permit unauthorized commenting, voting, and viewing of restricted content (CVE-2026-92586, CVE-2026-92585, CVE-2026-92577).
  • A stored XSS vulnerability (CVE-2026-92584) and a race condition bypassing rate limits (CVE-2026-92583) were also identified.
  • All vulnerabilities affect AVideo version 29.0 and earlier; patching is strongly recommended.

On September 15-16, 2026, a batch of twelve vulnerabilities was disclosed for WWBN's AVideo platform, affecting version 29.0 and earlier. The vulnerabilities span several categories, including authentication bypass, cross-site scripting (XSS), server-side request forgery (SSRF), and access control flaws, with several rated as High severity. These disclosures highlight potential risks for administrators and users of AVideo instances, particularly concerning unauthorized access to sensitive information and system manipulation.

Several vulnerabilities revolve around improper access control and permission validation. CVE-2026-92586 and CVE-2026-92585, both rated Medium, allow authenticated users to post comments on or vote on password-protected and group-restricted videos, respectively, by exploiting flaws in the set_api_comment and API like endpoints. Similarly, CVE-2026-92579 (Medium) allows anonymous callers to retrieve restricted videos and owner Personally Identifiable Information (PII) through the get_api_video endpoint due to broken access control. Another access control issue, CVE-2026-92565 (High), fails to enforce user-group restrictions on live transmission endpoints, exposing stream keys, titles, descriptions, owner information, and playback URLs to unauthenticated attackers.

Cross-site scripting (XSS) and authentication bypass vulnerabilities are also present. CVE-2026-92584 (Medium) is a stored XSS vulnerability where the VideoStatistic::save() function writes unrecognized User-Agent strings to the system, potentially leading to script execution. A more severe authentication bypass, CVE-2026-92578 (High), allows attackers to authenticate as any user by providing a stored password hash through specific code paths in loginFromRequest() and encryptPasswordVerify(). Furthermore, CVE-2026-92582 (High) is a cross-site request forgery (CSRF) vulnerability in objects/videoAddNew.json.php due to the disabling of CSRF guards under certain parameter conditions.

Server-side request forgery (SSRF) is another significant theme within this batch. CVE-2026-91967 (Medium) contains a blind SSRF vulnerability in the getHeaderContentTypeFromURL function, allowing authenticated users with upload permissions to trigger requests to attacker-chosen URLs. CVE-2026-91966 (Medium) is an unauthenticated SSRF vulnerability in the check_site_availability function, enabling attackers to probe internal network hosts and ports by manipulating HTTP Host headers.

A notable race condition vulnerability, CVE-2026-92583 (Medium), affects the enforceRateLimit() function. It fails to atomically increment rate limit counters, allowing attackers to bypass rate limits, including login brute-force protection, through concurrent requests. Lastly, CVE-2026-92577 (High) involves broken access control in the get_api_video endpoint, allowing anonymous users to access restricted videos and owner PII.

The vulnerabilities were disclosed by WWBN, with related coverage from Vypr Intelligence highlighting the SSRF and information disclosure flaws. All reported vulnerabilities affect AVideo version 29.0 and earlier. Users are strongly recommended to update to a patched version to mitigate these security risks.

The batch of vulnerabilities underscores the importance of rigorous access control, input validation, and secure handling of sensitive data within the AVideo platform. Administrators should prioritize updating their instances and review their security configurations to prevent potential exploitation of these weaknesses.

The disclosed vulnerabilities include:

The affected version is AVideo through 29.0. Patches are available for these issues.

Vypr Intelligence

CVE-2026-92586, CVE-2026-92585, CVE-2026-92584, CVE-2026-92583, CVE-2026-92582, CVE-2026-92581, CVE-2026-92579, CVE-2026-92578, CVE-2026-92577, CVE-2026-91967, CVE-2026-91966, CVE-2026-91965

AI-written article. Grounded in 13 CVE records listed below.