CVE-2026-56342: AVideo - Server-Side Request Forgery in Live/test.php via statsURL Parameter
AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to private IP ranges and cloud metadata endpoints. Attackers can exploit this by crafting requests to internal services, cloud metadata endpoints like 169.254.169.254, and localhost to retrieve sensitive information including IAM credentials, internal service responses, and network configuration details.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify plugin/Live/test.php to validate the statsURL parameter using isSSRFSafeURL() and reject or sanitize any statsURL that resolves to private IP ranges or known cloud metadata endpoints such as 169.254.169.254.
AVideo plugin/Live/test.php statsURL validation = apply isSSRFSafeURL() validation; block requests that resolve to private IP ranges and cloud metadata endpoints (e.g., 169.254.169.254) - Operational
Audit logs for any requests made via plugin/Live/test.php to internal addresses or cloud metadata endpoints (including 169.254.169.254). If IAM credentials, secrets, or other sensitive data may have been exposed, rotate those IAM credentials and any exposed secrets immediately.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-56342?
CVE-2026-56342 has a severity rating of medium, with a score of 6.8.
How does CVE-2026-56342 affect AVideo?
CVE-2026-56342 affects AVideo versions through 27.0 by allowing authenticated administrators to exploit server-side request forgery in live/test.php.
What can exploit CVE-2026-56342?
CVE-2026-56342 can be exploited by sending crafted requests through the statsURL parameter, which processes insufficient validation.
Is there a patch available for CVE-2026-56342?
As of now, there is no information provided about a patch for CVE-2026-56342.
What can an attacker achieve by exploiting CVE-2026-56342?
An attacker can use CVE-2026-56342 to read arbitrary internal URLs or sensitive data within the private network.