CVE-2026-27732 json
AVideo has Authenticated Server-Side Request Forgery via downloadURL in aVideoEncoder.json.php
published 8mo ago modified 2mo ago also GHSA-h39h-7cvg-q7j6 , EUVD-2026-8527
- cvss
- 8.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 19%
- public exploits
- 0
- none known
Summary
WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allows authenticated users to trigger server-side requests to arbitrary URLs (including internal network endpoints). An authenticated attacker can leverage SSRF to interact with internal services and retrieve sensitive data (e.g., internal APIs, metadata services), potentially leading to further compromise depending on the deployment environment. This issue has been fixed in AVideo version 22.0.
Patch / fix
- packagist wwbn/avideo 22.0
- wwbn avideo 22.0
Is CVE-2026-27732 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- total
- Assessed
- 8mo ago
Exploit prediction
0.27% chance of exploitation in the next 30 days, higher than 19% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.6 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| GitHub | 3.1 | 8.1 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | wwbn/avideo | <22.0 |
22.0 |
Affected products
- WWBN AVideo
Classification
- Weakness
-
- CWE-918 Server-Side Request Forgery
References
-
github.com
/WWBN/AVideo/commit/384ef2548093f4cbb1bfac00f1f429fe57fab853
web, patch
-
github.com
/WWBN/AVideo/security/advisories/GHSA-h39h-7cvg-q7j6
web, vendor-advisory
-
github.com
/WWBN/AVideo/releases/tag/22.0
web, product
-
nvd.nist.gov
/vuln/detail/CVE-2026-27732
advisory
-
github.com
/WWBN/AVideo
package
Sources
- CVE List CVE-2026-27732
- GitHub Advisory GHSA-h39h-7cvg-q7j6
- NVD CVE-2026-27732
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.