CVE-2026-56342

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 27.1

Description Authenticated administrators can perform server-side request forgery (SSRF)—a flaw where a server is tricked into making requests to an unintended location—via the 'plugin/Live/test.php' endpoint. The issue occurs because the statsURL parameter lacks isSSRFSafeURL() validation, allowing requests to be sent to localhost, private IP ranges, and cloud metadata endpoints such as 169.254.169.254. This can be exploited to retrieve sensitive data, including internal service responses, network configuration details, and IAM credentials.

Recommendations Update to a version later than 27.0. As a temporary workaround, restrict access to the 'plugin/Live/test.php' endpoint or avoid using the statsURL parameter until the update is applied.