p PatchFirst

CVE-2026-39368

CVE-2026-39368 · WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services

This page contains facts from public vulnerability sources. Check the original advisory before updating.

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.

CVSS 6.5 · Medium · EPSS 0.2%

Published
Updated

Stack: php

Affected products and versions

  • avideo

    Versions
    • <= 26.0: Affected

    No fix published

  • wwbn/avideo Packagist

    Affected ranges
    • ECOSYSTEM: ≤ 26.0

    No fix published

Original sources

Check your server →