Avideo CVE-2026-39368

This vulnerability presents moderate real-world risk balanced between technical severity and practical constraints. The CVSS 6.5 score reflects a network-accessible attack with low complexity and high confidentiality impact (information disclosure from internal services), but no integrity or availability impact. Crucially, the attack requires prior authentication (PR:L per CVSS vector), limiting the threat model to legitimate platform users with streaming permissions. CISA SSVC data indicates a proof-of-concept exists (Exploitation: poc) and the technical impact is partial (Exploitation: partial), suggesting the attack is feasible but not fully automated (Automatable: no). The stored nature of the SSRF increases dwell time and detection difficulty compared to transient variants. For organizations with strict access controls limiting who can obtain streaming privileges, risk is lower; for open-registration platforms or those with many streamers, this becomes a vector for internal reconnaissance or exfiltration of metadata from internal services. The absence of documented active exploitation (no KEV status) and the requirement for valid credentials suggest this is not an immediate mass-exploitation risk, but it warrants prompt patching for affected deployments.

A malicious streamer or compromised account with streaming permissions logs into WWBN AVideo and configures a live restream with a callback URL pointing to http://127.0.0.1:8080/internal-admin-panel or an attacker-controlled server (e.g., attacker.com/exfil). When the restream log feature later fetches and processes this stored URL, the application server makes the HTTP request, allowing the attacker to probe internal services, enumerate internal IP addresses, or capture response metadata. Because the SSRF is stored, the attacker can trigger multiple requests across sessions without re-authentication, and detection may be delayed if audit logs do not explicitly track callback URL fetches.