WWBN AVideo's Scheduler plugin prior to version 26.0 has an SSRF vulnerability due to insufficient validation of the admin-configurable callbackURL parameter in the run() function. The callbackURL is validated only by a format check (isValidURL()) but not by the stricter isSSRFSafeURL() function that blocks requests to private IP ranges, loopback addresses, and cloud metadata endpoints. This flaw enables an attacker with admin privileges to configure scheduled tasks that can perform SSRF attacks against internal network services. The vulnerability is addressed in version 26.0 by applying proper SSRF-safe URL validation.

An attacker with administrative privileges can exploit this vulnerability to cause the server to make unauthorized requests to internal network resources, including cloud infrastructure metadata services or internal APIs that are otherwise inaccessible from the internet. This can lead to unauthorized information disclosure (confidentiality impact is high), though integrity and availability impacts are low. The CVSS score is 5.5 (medium severity). There are no known exploits in the wild.

Upgrade WWBN AVideo to version 26.0 or later, where the Scheduler plugin's callbackURL parameter is properly validated using isSSRFSafeURL() to block SSRF attempts to private, loopback, and cloud metadata addresses. Until the upgrade is applied, restrict administrative access to trusted users only, as exploitation requires admin privileges. Patch status is confirmed fixed in version 26.0.