Vulnerability · Published Feb 24, 2026 · Assigned by GitHub_M

CVE-2026-27732AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php

High 8.6

In plain English

A high-severity server-side request forgery in AVideo from WWBN. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 19% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.6High

Exploit odds (30 days)0.3%top 80.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	22.0	GHSA-h39h-7cvg-q7j6

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	< 22.0

Weakness: CWE-918 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6 x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853 x_refsource_MISC
https://github.com/WWBN/AVideo/releases/tag/22.0 x_refsource_MISC