CVE-2026-27732: AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-02-24 · updated 2026-06-17
Weakness: CWE-918

Description

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.

Affected products

WWBN AVideo: before 22.0 — fixed in 22.0

How to fix

Upgrade to a fixed version: WWBN AVideo 22.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-27732 or the next vulnerability affects your stack