CVE-2026-33502: AVideo has Unauthenticated SSRF via plugin/Live/test.php

Severity: high (CVSS 8.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-23 · updated 2026-06-17
Weakness: CWE-918

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in `plugin/Live/test.php` allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 contains a patch.

Affected products

WWBN AVideo: through 26.0

References

https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a5318204b010ea28440b0d9a5ab3
https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc
https://github.com/WWBN/AVideo/security/advisories/GHSA-3fpm-8rjr-v5mc

Get alerted when CVE-2026-33502 or the next vulnerability affects your stack