CVE-2026-56342 Details
Description
AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to private IP ranges and cloud metadata endpoints. Attackers can exploit this by crafting requests to internal services, cloud metadata endpoints like 169.254.169.254, and localhost to retrieve sensitive information including IAM credentials, internal service responses, and network configuration details.
A server-side request forgery (SSRF) vulnerability has been identified in AVideo versions through 27.0. The issue resides in the Live test plugin, specifically within the test.php file. This vulnerability allows authenticated administrators to read arbitrary URLs by exploiting the statsURL parameter, which fails to undergo proper validation. The lack of isSSRFSafeURL() validation enables requests to private IP ranges and cloud metadata endpoints, such as 169.254.169.254. Exploitation of this vulnerability could lead to the retrieval of sensitive information, including IAM credentials, internal service responses, and network configuration details.
To address this vulnerability, add 'isSSRFSafeURL()' validation before fetching the URL in 'plugin/Live/test.php'. Also, enable SSL verification in the cURL handler and the file_get_contents stream context.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 20, 2026CISA-ADP
Assessed Jun 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjx-r2j2-96fx | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-wxjx-r2j2-96fx | [email protected] | AdvisoryExploitRemedyVendor |
| https://www.vulncheck.com/advisories/avideo-server-side-request-forgery-in-live-test-php-via-statsurl-parameter | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| WWBN AVideo | <= 27.0 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 22, 2026 | CVE Modified | CISA-ADP |
| Jun 20, 2026 | New CVE Received | [email protected] |