Can you explain this vulnerability to me?

CVE-2026-39368 is a stored Server-Side Request Forgery (SSRF) vulnerability in WWBN AVideo versions 26.0 and prior. It occurs in the Live restream log callback flow, where an attacker-controlled URL (restreamerURL) is accepted and stored by the server without proper validation.

Later, the server fetches this stored URL server-side, allowing an authenticated user with streaming permission (a low-privilege user) to trigger HTTP requests from the server to internal or loopback services. This means the attacker can make the server send requests to internal network services that are normally inaccessible externally.

The vulnerability arises because the server accepts a response token without strictly limiting the callback destination to trusted endpoints, enabling abuse of the restream log feature to perform SSRF.

Useful 0 Not Useful 0

How can this vulnerability impact me? :

This vulnerability allows an authenticated streamer with low privileges to abuse the server to send HTTP requests to internal or loopback services that are normally protected from external access.

• The server can act as a proxy to access sensitive internal-only services such as admin panels, internal APIs, or cloud metadata services.
• This can lead to unauthorized disclosure of confidential information stored on internal services.
• Since the attacker only needs streaming permission and no user interaction, the attack complexity is low.

Useful 0 Not Useful 0

How can this vulnerability be detected on my network or system? Can you suggest some commands?

This vulnerability can be detected by observing the server-side requests triggered by authenticated streamers with streaming permission. Specifically, monitoring calls to the endpoints involved in the vulnerable flow can help identify exploitation attempts.

• Check for requests to the endpoint `plugin/Live/view/getRestream.json.php` that include unusual or unexpected callback URLs.
• Monitor POST requests to `plugin/Live/view/Live_restreams_logs/add.json.php` where attacker-controlled `restreamerURL` values might be stored.
• Look for exchanges of tokens via `plugin/Live/view/Live_restreams/verifyTokenForAction.json.php` that could be used to validate malicious callback URLs.

Suggested commands to detect suspicious activity might include using curl or similar tools to simulate or inspect these requests, for example:

• curl -X GET 'https://your-avideo-instance/plugin/Live/view/getRestream.json.php?parameters' -H 'Authorization: Bearer <token>'
• curl -X POST 'https://your-avideo-instance/plugin/Live/view/Live_restreams_logs/add.json.php' -d 'restreamerURL=http://127.0.0.1:9999/index.php' -H 'Authorization: Bearer <token>'

Additionally, network monitoring tools can be used to detect unexpected outbound HTTP requests from the server to internal or loopback addresses, which may indicate exploitation of the SSRF vulnerability.

Useful 0 Not Useful 0

What immediate steps should I take to mitigate this vulnerability?

Immediate mitigation steps include implementing strict validation and restrictions on the `restreamerURL` to prevent attacker-controlled URLs from being stored or used.

• Validate the `restreamerURL` against a whitelist of explicitly configured, trusted restreamer endpoints at the time of storage.
• Re-validate the stored callback URL before each server-side fetch to ensure it remains within trusted boundaries.
• Bind the `responseToken` to the expected restream row and callback host to prevent token misuse.
• Apply SSRF validation to all initial server-side fetch destinations, not just redirect targets.
• Reject or ignore user-supplied callback hosts that do not match trusted configurations.

Since no patched versions are available at the time of the advisory, these validation and filtering measures are critical to reduce the risk of exploitation.

Useful 0 Not Useful 0

How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

The vulnerability allows an authenticated low-privilege user to cause the server to make HTTP requests to internal or loopback services, potentially exposing sensitive internal-only services such as admin panels, internal APIs, or cloud metadata services.

This unauthorized disclosure of confidential information could lead to violations of data protection regulations and standards that require safeguarding sensitive data, such as GDPR and HIPAA.

Therefore, the SSRF vulnerability may negatively impact compliance by increasing the risk of unauthorized access to sensitive internal data, which these regulations mandate to protect.

Useful 0 Not Useful 0