CVE-2026-85164: WWBN AVideo Server-Side Request Forgery via set_api_userImages
WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the setapiuserImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal services, with responses written to publicly accessible web paths for retrieval.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated API client needs to call the set_api_userImages endpoint. No user interaction is required, and the attack can be performed over the network.
What can an attacker access through the vulnerable endpoint?
The attacker can provide internal URLs in the profileImg or backgroundImg fields, causing the server to fetch cloud metadata endpoints or internal services. Retrieved responses are written to publicly accessible web paths, allowing the attacker to retrieve them.
How can I determine whether my deployment is affected?
Check whether your WWBN AVideo deployment includes commit c91b5975d or an earlier affected state, and whether authenticated API clients can access set_api_userImages. Review requests to that endpoint for profileImg or backgroundImg values targeting internal addresses or cloud metadata services.
What can be done if patching is not immediately possible?
Restrict access to the set_api_userImages API endpoint to trusted authenticated clients and block server-side outbound requests to internal networks and cloud metadata services where possible. Monitor and investigate image URL submissions for internal or otherwise unexpected destinations.