WWBN AVideo: Three SSRF and Info Disclosure Flaws Disclosed Together
Key findings • Three vulnerabilities in WWBN AVideo through v29.0 disclosed on September 15, 2026. • Two SSRF vulnerabilities (CVE-2026-91967, CVE-2026-91966) allow network probing and extern…
Key findings
- Three vulnerabilities in WWBN AVideo through v29.0 disclosed on September 15, 2026.
- Two SSRF vulnerabilities (CVE-2026-91967, CVE-2026-91966) allow network probing and external requests.
- One High-severity information disclosure (CVE-2026-91965) exposes stream keys and playback URLs.
- Unauthenticated attackers can exploit CVE-2026-91965 and CVE-2026-91966.
- All vulnerabilities affect AVideo version 29.0 and earlier; patching is recommended.
WWBN disclosed three vulnerabilities in its AVideo platform on September 15, 2026, with two critical SSRF flaws and one information disclosure vulnerability. The batch of vulnerabilities, all affecting AVideo version 29.0 and earlier, were published together, indicating a coordinated disclosure event. These flaws could allow unauthenticated attackers to probe internal networks, access sensitive stream keys, and potentially disrupt video services.
Two of the vulnerabilities, CVE-2026-91967 and CVE-2026-91966, are related to Server-Side Request Forgery (SSRF). CVE-2026-91967, rated Medium with a CVSSv3 score of 5.0, resides in the getHeaderContentTypeFromURL function. It allows authenticated users with upload permissions to store malicious URLs as video links, which are then processed by a vulnerable get_headers() call that is only loosely guarded by format validation. This could lead to the server making requests to arbitrary external or internal resources.
CVE-2026-91966, also rated Medium with a CVSSv3 score of 5.8, is an unauthenticated SSRF vulnerability within the check_site_availability function. This flaw is triggered by attacker-controlled HTTP Host headers. By sending crafted requests to submitIndex.php or ajax.php, attackers can probe internal network hosts and ports, potentially discovering other vulnerable services or sensitive information within the network infrastructure.
The third vulnerability, CVE-2026-91965, rated High with a CVSSv3 score of 7.5, is an information disclosure flaw. It affects the plugin/Live/stats.json.php and plugin/Live/calendar.json.php endpoints. AVideo fails to properly enforce user-group restrictions in these endpoints, allowing unauthenticated attackers to access sensitive details about live transmissions. This includes stream keys, titles, descriptions, owner information, and direct HLS playback URLs, which could be misused for unauthorized access or disruption of live streams.
All three vulnerabilities affect AVideo through version 29.0. Users are advised to update to a patched version as soon as possible to mitigate these risks. The coordinated disclosure of these vulnerabilities highlights the importance of timely patching and security reviews for AVideo users.
The disclosure of these SSRF and information disclosure vulnerabilities in AVideo underscores the need for continuous security vigilance. Attackers could leverage these flaws to gain deeper access into internal networks or compromise sensitive live stream data. Promptly updating to a secure version is crucial for all AVideo deployments to protect against potential exploitation.