CVE-2026-27732 — Server-Side Request Forgery in Avideo
Severity
8.6HIGHNVD
NVD7.1
EPSS
0.0%
top 89.41%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 24
Latest updateApr 8
Description
WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata ser…
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Affected Packages3 packages
Patches
🔴Vulnerability Details
3GHSA▶
WWBN AVideo has an Allowlisted downloadURL media extensions bypass SSRF protection and enable internal response exfiltration (Incomplete fix for CVE-2026-27732)↗2026-04-08
OSV▶
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php↗2026-02-25
GHSA▶
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php↗2026-02-25