Threat Intelligence Database

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

WWBN AVideo versions 29.0 and below are vulnerable to an OS command injection due to incomplete sanitization of special characters in commands executed by the platform. The vulnerability arises because the fix for a prior related issue (CVE-2026-33482) did not neutralize the single ampersand (&) character, which allows chaining multiple commands. This can lead to arbitrary command execution on the standalone encoder server if an attacker can craft a valid encrypted payload. The issue has been addressed in a patch committed to the project's repository.

WWBN AVideo versions prior to 29.0 contain a vulnerability in the Authorize.Net webhook handler that allows attackers to bypass signature verification. This flaw enables forging webhook requests with arbitrary payment amounts and user IDs, resulting in unauthorized wallet credits and activation of premium subscriptions without payment. The issue arises from a combination of signature bypass logic, payload overriding API values, and missing approval checks. The vulnerability has been fixed in version 29.0.

WWBN AVideo versions prior to 29.0 have a vulnerability where the .env file is exposed to unauthenticated users due to the official Docker compose configuration mounting the project root as the Apache document root. This exposure allows attackers to access sensitive information such as database credentials and admin passwords. The issue is resolved in version 29.0.

AVideo through 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint where notifyCode and callback parameters are concatenated into a shell command without escaping. Attackers who can craft a valid encrypted payload can inject arbitrary shell metacharacters into these fields to execute OS commands as the web-server user.

AVideo through 29.0 contains an OS command injection vulnerability in plugin/API/standAlone/functions.php where the listFFmpegProcesses() function interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

WWBN AVideo versions prior to 29.0 contain a stored DOM-based Cross-Site Scripting (XSS) vulnerability in the YPTSocket plugin. An unauthenticated attacker can inject malicious JavaScript via WebSocket connection parameters, which are broadcast and rendered in the admin dashboard without proper validation. This allows execution of arbitrary scripts in the context of authenticated administrators, leading to full administrative takeover. The vulnerability has been patched in version 29.0.

WWBN AVideo versions 29.0 and below contain a stored Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI plugin. The vulnerability arises because the plugin renders the YouTube video title without HTML encoding, treating it as trusted content. An attacker controlling a YouTube video title matching the configured query can inject malicious JavaScript that executes in the browsers of visitors to the AVideo homepage. If the visitor is an administrator, the injected script can perform administrative actions without additional CSRF protection, leading to full administrative takeover. The malicious payload persists for the duration of the cache timeout and can survive removal of the hostile video on YouTube. A fix has been committed but no official patch release information is provided.

WWBN AVideo is an open source video platform. Versions 29.0 and below contain a Stored XSS vulnerability through the autoEvalCodeOnHTML parameter in the MessageSQLite WebSocket Handler. The MessageSQLite.php handler only strips autoEvalCodeOnHTML from $json['msg'], but msgToResourceId() reads from $msg['json'] with higher priority. An attacker can place the XSS payload in the json key instead of msg, bypassing the sanitization entirely. An authenticated attacker can execute arbitrary JavaScript in any connected user's browser session via the WebSocket messaging system, stealing session cookies and authentication tokens, taking over accounts through session hijacking, and chaining with CSRF to perform admin actions on the victim's behalf, in the default SQLite WebSocket backend configuration. This issue has a patch that has yet to be officially released, see https://github.com/WWBN/AVideo/commit/3e0b3ce2bfa766183ff0ae227439394db57b1a23.

WWBN AVideo versions prior to 29.0 contain a missing authorization vulnerability in the signUp API that allows privilege escalation. Attackers who can solve a CAPTCHA can self-assign elevated permissions such as emailVerified, canUpload, canStream, and canCreateMeet during account registration without proper authentication. This bypasses intended access controls and allows unauthorized capabilities. The issue is fixed in version 29.0.