CVE-2026-39368: WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal services
Summary
The Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers.
The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.
Details
The vulnerable chain was:
1. plugin/Live/view/getRestream.json.php exposed a fresh tokenForAction 2. plugin/Live/view/Liverestreams/verifyTokenForAction.json.php exchanged it for a valid responseToken 3. plugin/Live/view/Liverestreamslogs/add.json.php accepted attacker-controlled restreamerURL 4. plugin/Live/view/getRestream.json.php and plugin/Live/view/Liverestreams/getAction.json.php later fetched that stored URL server-side
The original issue existed because the responseToken was accepted, but the callback destination was not tightly constrained to trusted restreamer endpoints.
The maintainer confirmed the vulnerability and stated that the fix was applied by validating restreamerURL at storage time and re-validating the log-entry branch before use. The maintainer also noted that the m3u8 field follows the same general pattern but is not server-fetched in the current flow.
Proof of concept
1. Log in as a non-admin user with streaming permission. 2. Create a normal restream destination. 3. Trigger plugin/Live/view/Liverestreams/testRestreamer.json.php to create a live transmission history row. 4. Call:
text GET /plugin/Live/view/getRestream.json.php?livetransmitionshistoryid=<id>&restreamsid=<id>
5. Extract tokenForAction from the returned URL. 6. Exchange it for responseToken via:
text POST /plugin/Live/view/Liverestreams/verifyTokenForAction.json.php
7. Store a loopback callback URL:
text POST /plugin/Live/view/Liverestreamslogs/add.json.php restreamerURL=http://127.0.0.1:9999/index.php
8. Trigger getRestream.json.php again. 9. Observe that the returned response now contains the JSON body from the loopback-only service.
Impact
An authenticated streamer can cause the AVideo server to send HTTP requests to loopback or internal services and return the response through normal application endpoints by storing a malicious restreamerURL in the restream log flow. Because the callback destination was not constrained to trusted restreamer endpoints, the application could be used as a proxy to internal-only services that trust network locality. Successful exploitation can expose local admin panels, internal-only APIs, cloud metadata services if reachable, or other sensitive internal responses available from the application host.
Recommended fix
- Validate restreamerURL against explicitly configured restreamer endpoints at storage time - Re-validate the stored callback URL before server-side fetch - Bind responseToken to the expected restream row and callback host - Apply SSRF validation to the initial destination of every server-side fetch, not only redirect targets - Ignore or reject user-supplied callback hosts that do not match trusted configuration
Other sources
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
At the time `plugin/Live/view/Live_restreams_logs/add.json.php` accepts `restreamerURL`, validate it against explicitly configured restreamer endpoints in storage logic, and reject/ignore attacker-supplied callback hosts that do not match trusted configuration.
AVideo Live restream log callback flow restreamerURL validation at storage time = Validate that restreamerURL matches explicitly configured trusted restreamer endpoints; otherwise reject/ignore it - Configuration
Before `getRestream.json.php`/log-entry branch fetches the stored callback URL server-side, re-validate the stored callback URL to ensure it still matches trusted, explicitly configured restreamer endpoints.
AVideo Live restream log callback flow callback URL re-validation before server-side fetch = Re-validate the stored callback URL prior to fetching - Configuration
Add SSRF validation that constrains the initial destination of every server-side fetch (e.g., in the restream log fetch path), not just the redirect target.
AVideo server-side fetch SSRF protection SSRF validation target constraint = Apply SSRF validation to the initial destination of every server-side fetch, not only redirect targets - Configuration
Update token handling so `responseToken` is cryptographically/semantically bound to the expected restream row and callback host, preventing token/proxying across mismatched destinations.
AVideo Live restream tokens responseToken binding = Bind `responseToken` to the expected restream row and callback host - Configuration
Ensure the `restreamerURL` provided in the restream log flow is checked against explicitly configured restreamer endpoints when storing the restream log entry (the storage-time validation described by the maintainer-fix).
AVideo Live restreamer endpoints restreamerURL allowlist against configured endpoints at restream time = Validate restreamerURL against explicitly configured restreamer endpoints at storage time
Event History
Frequently Asked Questions
What is the severity of CVE-2026-39368?
The severity of CVE-2026-39368 is considered medium due to the potential for authenticated attackers to exploit stored SSRF vulnerabilities.
How do I fix CVE-2026-39368?
To fix CVE-2026-39368, ensure that user-controlled input for the `restreamerURL` is properly validated and sanitized before processing.
Which versions of WWBN AVideo are affected by CVE-2026-39368?
CVE-2026-39368 affects all versions of WWBN AVideo up to and including version 26.0.
What is SSRF in the context of CVE-2026-39368?
In the context of CVE-2026-39368, SSRF stands for Server-Side Request Forgery, allowing attackers to send requests to internal services.
Who is at risk with CVE-2026-39368?
Authenticated streamers using vulnerable versions of WWBN AVideo are at risk of exploitation through stored SSRF.