WWBN AVideo versions 26.0 and earlier contain a stored SSRF vulnerability (CWE-918) in the Live restream log callback flow. An authenticated user with streaming permission can submit an attacker-controlled restreamerURL, which the server later fetches. This enables SSRF attacks that can access internal or loopback HTTP services. The vulnerability has a CVSS 3.1 score of 6.5, reflecting a network attack vector, low attack complexity, and low privileges required. Confidentiality impact is high due to potential unauthorized internal resource access, while integrity and availability impacts are none. No vendor advisory or patch information is currently available, and no exploits are known in the wild.

An authenticated low-privilege user with streaming permissions can exploit this vulnerability to cause the server to make arbitrary HTTP requests to internal or loopback services. This can lead to unauthorized access to sensitive internal resources, potentially exposing confidential information. There is no direct impact on data integrity or system availability reported. The medium severity rating reflects the moderate risk posed by this SSRF vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict streaming permissions to trusted users only and monitor for suspicious activity related to restream log callbacks. Avoid exposing sensitive internal HTTP services that could be targeted by SSRF. Do not rely on generic mitigations; follow vendor updates closely.