CVE-2026-89242: WWBN AVideo SSRF Vulnerability

CVE-2026-89242 Overview

CVE-2026-89242 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in WWBN AVideo, an open-source video streaming platform. The flaw exists in the _json_decode function, which fetches remote URLs and local file paths without validation. Unauthenticated attackers can POST arbitrary file paths or HTTP URLs to login.json.php to read local files or reach internal network services. The response content is then parsed as login credentials, enabling both file disclosure and internal reconnaissance from a single unauthenticated endpoint. The vulnerability affects AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1.

Critical Impact
Unauthenticated attackers can read local files and probe internal services through a public login endpoint, exposing configuration data, credentials, and internal infrastructure.

Affected Products

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1
The vulnerable login.json.php endpoint
The _json_decode helper function within the AVideo codebase

Discovery Timeline

2026-09-11 - CVE-2026-89242 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-89242

Vulnerability Analysis

The vulnerability resides in AVideo's _json_decode helper, which accepts a string input and attempts to interpret it as JSON. Before parsing, the function tests whether the input represents a fetchable resource. When the string looks like a URL or a local file path, _json_decode retrieves the resource contents and forwards them into the JSON decoder without validating the destination.

The login.json.php endpoint passes user-controlled POST data directly into this helper. As a result, an unauthenticated attacker can supply an arbitrary URL or filesystem path and cause the server to fetch it. The retrieved bytes are then treated as candidate login credentials, producing observable differences in server responses that enable data exfiltration and internal service enumeration.

Root Cause

The root cause is missing SSRF validation in a data-fetch code path repurposed for authentication input. The _json_decode function was designed as a permissive JSON loader that transparently handles inline strings, remote resources, and local files. Exposing this behavior on an unauthenticated endpoint eliminates any allowlist, scheme restriction, or network boundary check.

Attack Vector

An attacker sends an HTTP POST request to login.json.php with a crafted parameter value containing either a file:// style local path or an http:// or https:// URL. The server dereferences the value, fetches the content, and processes it as JSON credential data. Attackers can target internal IP ranges, cloud metadata endpoints, or sensitive files such as configuration and credential stores accessible to the web server user.

See the GitHub Security Advisory GHSA-wqwf-wmvx-53jh and the VulnCheck Advisory on AVideo SSRF for additional technical detail.

Detection Methods for CVE-2026-89242

Indicators of Compromise

POST requests to login.json.php containing values beginning with http://, https://, file://, or absolute filesystem paths such as /etc/.
Outbound HTTP requests from the AVideo web server to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
Web server process reads of sensitive files including /etc/passwd, .env, or application configuration files that are not part of normal request handling.

Detection Strategies

Inspect web server access logs for POST parameters to login.json.php that contain URL schemes or path separators uncommon in username fields.
Correlate inbound requests to login.json.php with subsequent outbound network connections initiated by the PHP worker process.
Monitor for anomalous file read activity by the web server user, particularly against configuration directories and credential stores.

Monitoring Recommendations

Enable egress filtering logs and alert on connections from the AVideo host to internal subnets or cloud metadata IPs.
Deploy web application firewall rules that flag URL schemes and absolute paths appearing in authentication parameters.
Aggregate PHP and web server logs into a central analytics platform to baseline login.json.php traffic and surface deviations.

How to Mitigate CVE-2026-89242

Immediate Actions Required

Update WWBN AVideo to a build newer than commit c3edcc274c389816d434acadac07ee78eaf330c1 once a fixed release is published.
Restrict access to login.json.php from untrusted networks using a reverse proxy or WAF while a patch is being deployed.
Audit web server, application, and egress logs for prior exploitation attempts using the indicators listed above.

Patch Information

Refer to the GitHub Security Advisory GHSA-wqwf-wmvx-53jh for the authoritative patch commit and remediation guidance. Track the AVideo project repository for the fixed release and apply upgrades to all deployed instances.

Workarounds

Block outbound network access from the AVideo host to internal subnets, loopback, and cloud metadata addresses using host firewall or security group rules.
Run the PHP worker under a least-privileged system account that cannot read sensitive files such as /etc/shadow, private keys, or credential stores.
Deploy WAF signatures that reject login.json.php requests containing http://, https://, file://, or absolute path prefixes in POST parameters.

bash

# Example egress restriction using iptables to block SSRF pivoting
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT