Vulnerability · Published Jun 20, 2026 · Assigned by VulnCheck

CVE-2026-56342AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter

Medium 6.8

In plain English

A medium-severity server-side request forgery in AVideo from AVideo. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to private IP ranges and cloud metadata endpoints. Attackers can exploit this by crafting requests to internal services, cloud metadata endpoints like 169.254.169.254, and localhost to retrieve sensitive information including IAM credentials, internal service responses, and network configuration details.

Affected products (as reported)

Vendor	Product	Versions
AVideo	AVideo	0 – through 27.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

GHSA Advisory GHSA-wxjx-r2j2-96fx vendor-advisory
VulnCheck Advisory: AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter third-party-advisory