CVE-2026-27732: Wwbn Avideo SSRF Vulnerability

CVE-2026-27732 Overview

CVE-2026-27732 is a Server-Side Request Forgery (SSRF) vulnerability discovered in WWBN AVideo, an open source video platform. Prior to version 22.0, the aVideoEncoder.json.php API endpoint accepts a downloadURL parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs, including internal network endpoints.

Critical Impact

An authenticated attacker can leverage this SSRF vulnerability to interact with internal services and retrieve sensitive data such as internal APIs, cloud metadata services (e.g., AWS IMDS, GCP metadata), and other protected resources. This can potentially lead to further compromise depending on the deployment environment, including credential theft and lateral movement within internal networks.

Affected Products

• WWBN AVideo versions prior to 22.0
• Deployments exposing the aVideoEncoder.json.php API endpoint to authenticated users
• Cloud-hosted AVideo instances with access to metadata services

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-27732 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-27732

Vulnerability Analysis

This SSRF vulnerability exists in the aVideoEncoder.json.php file where the downloadURL parameter is processed without adequate validation. The endpoint is designed to download video content from remote URLs, but fails to implement proper URL validation or an allow-list mechanism. This allows authenticated users to craft requests that cause the server to fetch arbitrary URLs, effectively turning the AVideo server into a proxy for accessing internal resources.

The vulnerability is particularly dangerous in cloud environments where metadata services (such as AWS EC2 Instance Metadata Service at 169.254.169.254) can be accessed to retrieve IAM credentials, instance configuration, and other sensitive data. Additionally, attackers can probe internal network infrastructure, access internal APIs, and potentially interact with other services that trust requests from the AVideo server's IP address.

Root Cause

The root cause of this vulnerability is the lack of input validation and URL filtering in the downloadVideoFromDownloadURL function. The code directly accepts user-supplied URLs and fetches them without:

1. Validating the URL scheme (allowing file://, gopher://, and other dangerous protocols)
2. Checking against an allow-list of permitted domains
3. Blocking requests to private/internal IP ranges (RFC 1918 addresses, localhost, link-local addresses)
4. Implementing proper SSRF protection mechanisms

Attack Vector

The attack requires authentication to the AVideo platform. Once authenticated, an attacker can submit malicious requests to the aVideoEncoder.json.php endpoint with a crafted downloadURL parameter pointing to internal resources. The server will execute the request on behalf of the attacker and return the response, enabling data exfiltration from otherwise inaccessible internal services.

// Security patch in objects/aVideoEncoder.json.php
// Source: https://github.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853

{
    global $global, $obj;
    $downloadURL = trim($downloadURL);

    // SSRF Protection: Validate URL before downloading
    if (!isSSRFSafeURL($downloadURL)) {
        __errlog("aVideoEncoder.json:downloadVideoFromDownloadURL SSRF protection blocked URL: " . $downloadURL);
        return false;
    }

    __errlog("aVideoEncoder.json: Try to download " . $downloadURL);
    $file = url_get_contents($downloadURL);
    $strlen = strlen($file);

The patch adds a call to isSSRFSafeURL() which validates the URL before processing, blocking requests to internal or potentially dangerous endpoints.

Detection Methods for CVE-2026-27732

Indicators of Compromise

• Unusual outbound requests from the AVideo server to internal IP ranges (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254)
• Access logs showing requests to aVideoEncoder.json.php with suspicious downloadURL parameters
• Server requests to cloud metadata endpoints or internal service URLs
• Error logs containing SSRF-related blocked URL messages (in patched versions)

Detection Strategies

• Monitor web server access logs for requests to aVideoEncoder.json.php containing internal IP addresses or cloud metadata URLs in the downloadURL parameter
• Implement network-level monitoring for outbound connections from the AVideo server to internal network segments or metadata service IPs
• Deploy Web Application Firewall (WAF) rules to detect and block SSRF attempt patterns in URL parameters
• Enable application-level logging to capture all URL fetch operations and review for anomalous destinations

Monitoring Recommendations

• Configure alerts for any outbound HTTP/HTTPS requests from the AVideo server to RFC 1918 private address ranges
• Monitor for connections to well-known metadata service endpoints (e.g., 169.254.169.254, metadata.google.internal)
• Review authentication logs for accounts making frequent requests to the vulnerable endpoint
• Implement egress filtering to restrict the AVideo server's ability to connect to internal resources

How to Mitigate CVE-2026-27732

Immediate Actions Required

• Upgrade WWBN AVideo to version 22.0 or later immediately
• If immediate upgrade is not possible, restrict access to the aVideoEncoder.json.php endpoint
• Review access logs to determine if exploitation may have occurred
• Audit any cloud credentials or internal service access that may have been exposed

Patch Information

The vulnerability has been fixed in AVideo version 22.0. The patch implements SSRF protection via the isSSRFSafeURL() function, which validates URLs before processing download requests. The fix can be reviewed in the GitHub commit 384ef254 and the official security advisory GHSA-h39h-7cvg-q7j6.

Workarounds

• Disable or restrict access to the aVideoEncoder.json.php endpoint via web server configuration until patching is complete
• Implement network-level egress filtering to block the AVideo server from accessing internal networks and cloud metadata services
• Deploy a reverse proxy or WAF in front of the application to filter requests containing internal URLs in parameters
• Restrict authentication to only trusted users and audit existing user accounts

# Apache configuration to restrict access to vulnerable endpoint
# Add to .htaccess or virtual host configuration
<Files "aVideoEncoder.json.php">
    # Restrict to trusted IPs only until patched
    Require ip 10.0.0.0/8
    # Or disable entirely
    # Require all denied
</Files>

# Nginx configuration alternative
location ~* aVideoEncoder\.json\.php$ {
    # Allow only trusted networks
    allow 10.0.0.0/8;
    deny all;
}