WWBN AVideo version 0 contains an SSRF vulnerability in the _json_decode function. This function improperly handles input by fetching remote URLs and local file paths without validating them against SSRF attacks. An unauthenticated attacker can exploit this by sending POST requests to login.json.php with crafted file paths or URLs, enabling them to read local files or interact with internal network services. The response is parsed as login credentials, which could lead to unauthorized access or information disclosure.

An unauthenticated attacker can exploit this SSRF vulnerability to read local files or access internal services through the vulnerable _json_decode function. This can lead to unauthorized disclosure of sensitive information, including potentially valid login credentials, increasing the risk of further compromise. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected endpoint and implement network-level controls to limit internal service exposure. Avoid exposing the vulnerable functionality to untrusted users.