CVE-2026-39368 Details
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.
A stored server-side request forgery (SSRF) vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the Live restream log callback flow, where an attacker can inject a malicious restreamer URL. This URL is then fetched server-side, allowing authenticated streamers with low privileges to make requests to internal HTTP services or loopback addresses. The vulnerability exists because the application does not properly validate the callback URL against trusted restreamer endpoints before storing it.
Users are advised to validate the 'restreamerURL' against explicitly configured trusted endpoints at the time of storage, re-validate the URL before server-side fetching, and bind the 'responseToken' to the expected restream row and callback host. Additionally, apply SSRF validation to the initial destination of every server-side fetch and reject user-supplied callback hosts that do not match trusted configurations.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 7, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-q4x6-6mm2-crg9 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 22, 2026 | Initial Analysis | [email protected] |
| Apr 7, 2026 | New CVE Received | [email protected] |