CVE-2026-56342: AVideo SSRF Vulnerability in Live Plugin Exposes Credentials

Technical summary

The vulnerability exists in plugin/Live/test.php where the statsURL parameter is processed without proper SSRF validation. Specifically, the code does not invoke isSSRFSafeURL() checks before making HTTP requests to the supplied URL. This permits requests to RFC 1918 private IP ranges, 169.254.169.254 (AWS/Azure/GCP metadata), and localhost services. An authenticated administrator can exploit this to perform server-side HTTP requests that leak sensitive internal data not normally exposed to the network boundary.

Business impact

Compromise of cloud IAM credentials or internal service tokens could grant attackers persistent access to cloud infrastructure, databases, or other backend systems. Reconnaissance of internal network architecture enables more sophisticated lateral movement attacks. If IAM credentials are exposed through metadata endpoints, attackers may pivot to cloud account takeover. The attack requires existing admin credentials, so it represents a post-compromise risk—but one that dramatically amplifies the damage from a credential breach or insider threat.

Affected systems

AVideo installations through version 27.0 are affected. The vulnerability is present in the Live plugin, so any deployment using that feature with admin accounts is at risk. Environments running AVideo in cloud infrastructure (AWS, Azure, GCP) or with sensitive internal services behind private IPs face elevated exposure.

Exploitability

Exploitation requires valid administrator credentials. No public exploit code is known at this time, and the vulnerability is not tracked in CISA's Known Exploited Vulnerabilities catalog. However, the attack is straightforward: an authenticated admin simply sends a crafted HTTP request to test.php with a statsURL pointing to an internal target. The lack of input validation and permissive request forwarding make this trivial to exploit once admin access is obtained.

Remediation

Upgrade AVideo to a patched version beyond 27.0. Until a patch is available, restrict admin panel access to trusted networks via firewall rules or VPN, implement network segmentation to isolate metadata endpoints (e.g., block 169.254.169.254 at the security group level), and audit admin account activity for suspicious HTTP requests. Consider disabling the Live plugin if not in active use.

Patch guidance

Verify the latest AVideo release notes and security advisories from the vendor for a patched version. Apply the update in a staging environment first to confirm compatibility with custom plugins or configurations. Monitor the AVideo GitHub repository or security announcements for release details, as version numbers should be confirmed against the official vendor advisory rather than assumed.

Detection guidance

Monitor HTTP requests originating from the AVideo application server to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), 169.254.169.254, or localhost. Log all admin access to plugin/Live/test.php and inspect statsURL parameters for internal IP addresses or metadata endpoint paths. Implement network-level detection for outbound requests to 169.254.x.x from application servers. Check application logs for repeated failed or successful requests to internal services, which may indicate reconnaissance.

Why prioritize this

Although this is a MEDIUM severity issue, it represents a significant post-compromise risk in cloud environments. The ability to extract IAM credentials or internal service tokens transforms a compromised admin account into infrastructure-wide compromise. Organizations using AVideo in AWS, Azure, or GCP should treat this as high-priority due to metadata endpoint exposure. For on-premises deployments with sensitive internal services, prioritize it accordingly based on network exposure and credential sensitivity.

Risk score, explained

The CVSS 3.1 score of 6.8 (MEDIUM) reflects the requirement for authenticated administrator credentials, limiting the attack surface. However, the score does not fully capture the business impact in cloud environments where metadata endpoints directly expose credential material. The high confidentiality impact (C:H) is appropriately weighted, but real-world risk depends heavily on deployment context—cloud instances with IAM roles are at substantially higher risk than isolated on-premises systems.

Frequently asked questions