CVE-2026-89242: WWBN AVideo Unauthenticated SSRF via login.json.php
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the jsondecode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can reach the affected AVideo instance can send a POST request to login.json.php. No credentials or user interaction are required.
What can an attacker request through the vulnerable endpoint?
The vulnerable _json_decode function can fetch attacker-supplied HTTP URLs and local file paths. This may let an attacker access internal services or read local files, with returned content parsed as login credentials.
How can I determine whether my deployment is affected?
Deployments are affected if they include the vulnerable code through commit c3edcc274c389816d434acadac07ee78eaf330c1 and expose login.json.php. The provided information does not identify a fixed release version.