CVE-2026-85164

Name of the Vulnerable Software and Affected Versions WWBN AVideo versions prior to commit c91b5975d

Description A server-side request forgery (SSRF) issue exists in the 'set api userImages' API endpoint. The system fails to validate the profileImg and backgroundImg URLs before fetching them. Authenticated API clients can provide internal URLs to retrieve cloud metadata or access internal services, and the resulting responses are written to publicly accessible web paths for retrieval.

Recommendations Update WWBN AVideo to a version beyond commit c91b5975d. As a temporary mitigation, restrict access to the 'set api userImages' API endpoint or avoid using the profileImg and backgroundImg parameters until the update is applied.