https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 14 Oct 2026 23:57:35 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-281167 EUVD-2026-281167 https://cve.radiocsirt.org/vuln/euvd-2026-281167 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39368 <p>WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.</p> <p>WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39368 https://cve.radiocsirt.org/vuln/ghsa-q4x6-6mm2-crg9 <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>## Summary</p> <p>The Live restream log callback flow accepted an attacker-controlled `restreamerURL` and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers.</p> <p>The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.</p> <p>## Details</p> <p>The vulnerable chain was:</p> <p>1. `plugin/Live/view/getRestream.json.php` exposed a fresh `tokenForAction` 2. `plugin/Live/view/Live_restreams/verifyTokenForAction.json.php` exchanged it for a valid `responseToken` 3. `plugin/Live/view/Live_restreams_logs/add.json.php` accepted attacker-controlled `restreamerURL` 4. `plugin/Live/view/getRestream.json.php` and `plugin/Live/view/Live_restreams/getAction.json.php` later fetched that stored URL server-side</p> <p>The original issue existed because the `responseToken` was accepted, but the callback destination was not tightly constrained to trusted restreamer endpoints.</p> <p>The maintainer confirmed the vulnerability and stated that the fix was applied by validating `restreamerURL` at storage time and re-validating the log-entry branch before use. The maintainer also noted that the `m3u8` field follows the same general pattern but is not server-fetched in the current flow.</p> <p>## Proof of concept</p> <p>1. Log in as a non-admin user with streaming permission. 2. Create a normal restream destination. 3. Trigger `plugin/Live/view/Live_restr…</p> <p><strong>Affected:</strong> Packagist: WWBN/AVideo</p> <p>## Summary</p> <p>The Live restream log callback flow accepted an attacker-controlled `restreamerURL` and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers.</p> <p>The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.</p> <p>## Details</p> <p>The vulnerable chain was:</p> <p>1. `plugin/Live/view/getRestream.json.php` exposed a fresh `tokenForAction` 2. `plugin/Live/view/Live_restreams/verifyTokenForAction.json.php` exchanged it for a valid `responseToken` 3. `plugin/Live/view/Live_restreams_logs/add.json.php` accepted attacker-controlled `restreamerURL` 4. `plugin/Live/view/getRestream.json.php` and `plugin/Live/view/Live_restreams/getAction.json.php` later fetched that stored URL server-side</p> <p>The original issue existed because the `responseToken` was accepted, but the callback destination was not tightly constrained to trusted restreamer endpoints.</p> <p>The maintainer confirmed the vulnerability and stated that the fix was applied by validating `restreamerURL` at storage time and re-validating the log-entry branch before use. The maintainer also noted that the `m3u8` field follows the same general pattern but is not server-fetched in the current flow.</p> <p>## Proof of concept</p> <p>1. Log in as a non-admin user with streaming permission. 2. Create a normal restream destination. 3. Trigger `plugin/Live/view/Live_restr…</p> https://cve.radiocsirt.org/vuln/ghsa-q4x6-6mm2-crg9