TI-2026-22093 Aliases CVE-2026-27732 GHSA-h39h-7cvg-q7j6

AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

MEDIUM 45CWE-918Published 2026-02-24 · Updated 2026-02-27

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0027 19th percentileScored 2026-11-07

Fix Fixed AVideo (WWBN): 22.0wwbn/avideo (Packagist): 22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
WWBN	AVideo	before 22.0	22.0	Patch available	CNA
—	wwbn/avideo (Packagist)	before 22.0	22.0	Patch available	GHSA-h39h-7cvg-q7j6

AVideo VendorWWBN Affected before 22.0 Fixed in 22.0 Patch available CNA
wwbn/avideo (Packagist) Vendor— Affected before 22.0 Fixed in 22.0 Patch available GHSA-h39h-7cvg-q7j6

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:wwbn:avideo::::::::	before 22.0	Vulnerable	WWBN

cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:* Versions before 22.0 Vulnerable ·WWBN

Remediation

Fix · CNA AVideo (WWBN) Fixed in 22.0
Fix · GHSA-h39h-7cvg-q7j6 wwbn/avideo (Packagist) Fixed in 22.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-27732
2026-10-03 Alias added: GHSA-h39h-7cvg-q7j6

References

Patch 1

https://github.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853

Advisory 2

Other 2

TI-2026-29567 Code injection in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-26095 AVideo Allows Unauthenticated Live Stream Control via Token Verification URL Override in control.json.php CVSS 3.1CRITICAL 9.4
TI-2026-25874 Improper access control in WWBN AVideo CVSS 3.1CRITICAL 10.0
TI-2026-25758 AVideo has an Unauthenticated SQL Injection via `doNotShowCats` Parameter (Backslash Escape Bypass) CVSS 3.1CRITICAL 9.8
TI-2024-20951 An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute… CVSS 3.1CRITICAL 9.8
TI-2023-10706 OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4… CVSS 3.1CRITICAL 9.8

See all 189 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences