WWBN AVideo CVE-2026-85164

Exploitation requires a valid authenticated API session with at least low-privilege access, as confirmed by the PR:L metric in the CVSS vector. The vulnerability is triggered through the set_api_userImages endpoint by supplying an internal or link-local URL in either the profileImg or backgroundImg parameters. The most severe impact - cloud IAM credential exfiltration - is limited to deployments hosted on cloud infrastructure (AWS, GCP, Azure) where instance metadata services are accessible from the application server host; on-premises deployments lose the IMDS threat vector but remain exposed to internal service enumeration and response disclosure. The exfiltration step additionally requires that the AVideo web process has write access to a publicly readable directory, which is the default application behavior. No non-default configuration flags or special product features need to be enabled beyond standard API access.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:L/UI:N with VC:H/VI:L) appropriately reflects a medium-high risk: the attack is network-accessible, low-complexity, and produces high confidentiality impact. The decisive risk amplifier is the non-blind response-exfiltration path - the server writes fetched content to a public web path, eliminating the guesswork inherent in traditional blind SSRF and making cloud metadata credential theft a reliable, single-step operation. On cloud-hosted deployments, successful exploitation can yield IAM role credentials enabling lateral movement that far exceeds the severity of the AVideo instance itself. The PR:L prerequisite (authenticated API session) partially constrains the attack surface, but if AVideo's API allows open or low-barrier registration, that constraint may be negligible in practice. No EPSS score was provided and no CISA KEV listing exists, so widespread opportunistic exploitation has not been observed; however, even a mid-sized municipal IT team in mielec running AVideo on cloud infrastructure should treat this as urgent given the cloud credential exposure risk. Non-cloud deployments face reduced but non-zero risk from internal service enumeration and response disclosure.

An attacker with a valid low-privilege AVideo API account sends a POST to set_api_userImages with profileImg set to http://169.254.169.254/latest/meta-data/iam/security-credentials/. The server fetches the IMDSv1 endpoint and writes the JSON credential response to a publicly accessible web directory path. The attacker issues a standard HTTP GET to retrieve the file, obtaining cloud IAM role credentials (access key, secret, session token) for immediate lateral movement within the cloud environment.