CVE-2026-64626: AVideo SSRF Vulnerability

CVE-2026-64626 Overview

CVE-2026-64626 is a server-side request forgery (SSRF) vulnerability [CWE-918] in AVideo, an open-source video streaming platform. The flaw affects versions from commit 0dbadbca through the latest master branch. The vulnerable code path resides in the encoder download-by-URL flow, where an unpinned retry fallback bypasses the DNS pinning validation that normally prevents SSRF. An authenticated attacker can supply a downloadURL that resolves to a public IP but redirects to an internal address. The unpinned retry follows the redirect and reaches internal targets, enabling blind SSRF against services on the internal network.

Critical Impact
Authenticated attackers can probe internal network services, cloud metadata endpoints, and non-routable infrastructure through blind SSRF, bypassing DNS pinning defenses.

Affected Products

AVideo (WWBN/AVideo) from commit 0dbadbca through latest master
Encoder component objects/aVideoEncoder.json.php
Deployments exposing the authenticated download-by-URL endpoint

Discovery Timeline

2026-07-20 - CVE-2026-64626 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-64626

Vulnerability Analysis

AVideo's encoder exposes an authenticated endpoint that downloads media from a caller-supplied URL. The endpoint invokes ssrfPinnedFetchToFile() with a pre-resolved IP ($resolvedIP_download) to enforce DNS pinning. This prevents DNS rebinding by forcing cURL to connect to the resolved public IP rather than re-resolving the hostname. The vulnerability arises when the pinned fetch fails. The code then retries the same URL with the pin argument set to null, allowing cURL to re-resolve the host and follow redirects to internal destinations such as 127.0.0.1, RFC1918 ranges, or cloud metadata endpoints like 169.254.169.254.

Root Cause

The root cause is an insecure error-handling branch that treats the DNS-pinning failure as recoverable. The retry logic drops the security control entirely instead of failing closed. Because the initial SSRF check only validates the first-hop IP, HTTP redirects returned by an attacker-controlled host on the retry path are followed without further validation.

Attack Vector

An authenticated user submits a downloadURL pointing to an attacker-controlled host that resolves publicly. The attacker's server returns an HTTP 3xx redirect to an internal target. When the pinned fetch fails, the unpinned retry follows the redirect and issues a request to the internal service. Responses are not returned to the attacker directly, producing a blind SSRF primitive suitable for internal port scanning, service enumeration, and metadata endpoint access.

php

_error_log("aVideoEncoder.json: Try to download " . $downloadURL . " to " . $temp);
$bytesSaved = ssrfPinnedFetchToFile($downloadURL, $temp, $resolvedIP_download, 7200);

// If DNS-pinned fetch failed, retry without DNS pin.
// The SSRF check above already confirmed the host resolves to a public IP (not
// private/loopback). This endpoint is authenticated (useVideoHashOrLogin at top), so
// only authorised callers reach this path. The MIME validation below is the primary
// defence against DNS rebinding: even if an attacker swaps DNS to an internal service,
// its response (JSON, HTML, config text) will be rejected by the MIME check.
if (!$bytesSaved && !empty($resolvedIP_download)) {
    _error_log("aVideoEncoder.json: DNS-pinned fetch failed; retrying without DNS pin for {$downloadURL}");
    $bytesSaved = ssrfPinnedFetchToFile($downloadURL, $temp, null, 7200);
}

// Validate MIME type of the downloaded file — must be video, audio, or a known archive.
if ($bytesSaved && function_exists('finfo_open')) {
    $finfo    = new finfo(FILEINFO_MIME_TYPE);
    $mimeType = $finfo->file($temp);
    $mimeOk   = (strpos($mimeType, 'video/') === 0)
             || (strpos($mimeType, 'audio/') === 0)
             || in_array($mimeType, [
                    'application/zip',
                    'application/x-zip',
                    'application/x-zip-compressed',
                    'application/octet-stream',
                ], true);
    if (!$mimeOk) {
        @unlink($temp);
    }
}

Source: AVideo Security Patch Commit — the patch adds MIME validation as a secondary defense against DNS rebinding after the unpinned retry.

Detection Methods for CVE-2026-64626

Indicators of Compromise

Log entries in AVideo error logs containing the string DNS-pinned fetch failed; retrying without DNS pin for attacker-supplied URLs.
Outbound requests from the AVideo host to RFC1918 addresses, 127.0.0.0/8, or link-local ranges such as 169.254.169.254.
Multiple downloadURL submissions from the same authenticated account targeting hosts that return HTTP 3xx redirects.

Detection Strategies

Instrument web server access logs for requests to aVideoEncoder.json.php that include a downloadURL parameter pointing to short-lived or newly registered domains.
Correlate authenticated AVideo sessions with unusual outbound HTTP traffic from the encoder host to internal ranges.
Alert on cURL user-agent traffic (getSelfUserAgent() output) reaching cloud metadata endpoints.

Monitoring Recommendations

Enable egress filtering logs and forward them to a centralized SIEM for correlation with application-layer events.
Monitor DNS resolutions performed by the AVideo host for domains that resolve to public IPs but then redirect via HTTP 3xx.
Track authentication events tied to the encoder endpoint and flag accounts issuing high volumes of download requests.

How to Mitigate CVE-2026-64626

Immediate Actions Required

Update AVideo to a version that includes the fix applied in commit 0dbadbcaaa1b415c7db078a72dc4b26d9fac0485.
Restrict encoder host egress at the network layer to only the destinations required for legitimate media downloads.
Audit accounts with permission to submit download URLs and revoke access from untrusted users.

Patch Information

The upstream fix in the WWBN/AVideo repository introduces MIME type validation on the downloaded file. Any response that is not video/*, audio/*, or a recognized archive MIME type is deleted from disk. The patch also sets CURLOPT_CONNECTTIMEOUT to 30 seconds to limit blind probing throughput. See the GitHub Security Advisory GHSA-fr98-mjq9-7jmj and the VulnCheck SSRF Advisory for additional context.

Workarounds

Block outbound access from the AVideo encoder host to internal CIDR ranges and cloud metadata IPs using firewall rules or a forward proxy.
Disable the download-by-URL feature if it is not required by the deployment.
Place the encoder in a network segment with no route to sensitive internal services.

bash

# Example iptables egress restriction blocking metadata and RFC1918 destinations
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 -j REJECT