CVE-2026-89242 in AVideo
Summary
by MITRE • 09/11/2026
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/11/2026
The vulnerability identified in WWBN AVideo represents a critical server-side request forgery flaw rooted in the improper handling of input data within the _json_decode function. This specific component is responsible for processing JSON payloads that are submitted via POST requests to the login.json.php endpoint. The core technical deficiency lies in the application's failure to validate or sanitize URLs and file paths before they are processed by internal functions designed to fetch remote content. By accepting arbitrary input without performing necessary checks against a whitelist of allowed domains, protocols, or local path restrictions, the software inadvertently allows attackers to manipulate the destination of these requests. This lack of validation creates an open redirect mechanism that can be exploited not only for traditional SSRF attacks targeting internal network services but also for reading sensitive files from the server's local filesystem through the use of file:// protocol schemes or relative paths.
From a technical perspective, this flaw is classified under CWE-918 Server-Side Request Forgery and specifically relates to CWE-20 Improper Input Validation. The attacker interacts with the login.json.php endpoint by crafting a malicious POST request that includes a specially constructed JSON payload. This payload contains either an HTTP URL pointing to an internal service, such as a database admin interface or metadata server, or a local file path targeting sensitive configuration files like /etc/passwd or application-specific credential stores. Because the results of these fetch operations are subsequently parsed and interpreted as login credentials by the authentication logic, the impact is significantly amplified beyond simple data exfiltration. The system effectively treats the content retrieved from arbitrary sources as valid user input for authentication purposes, creating a direct pathway for unauthorized access if the fetched content mimics expected credential formats or if the attacker can control parts of that content to bypass subsequent checks.
The operational impact of this vulnerability is severe due to its unauthenticated nature and high privilege escalation potential. An external actor with no prior credentials can exploit this flaw to read arbitrary files from the server, potentially exposing database connection strings, API keys, source code containing hardcoded secrets, or user data stored in local directories. Furthermore, by targeting internal services accessible only within the private network perimeter, such as Redis instances, MySQL databases, or cloud metadata endpoints like AWS EC2 instance profiles, an attacker can pivot further into the infrastructure. The unique aspect of this vulnerability is its integration with the authentication mechanism; if the fetched content contains data that resembles valid login structures, it may allow the attacker to impersonate legitimate users or administrators directly through the standard login flow, bypassing password verification entirely in some configurations.
To mitigate this risk, immediate remediation should focus on implementing strict input validation and output encoding practices within the _json_decode function and related request handling modules. Developers must enforce a whitelist approach for any URLs processed by fetch functions, allowing only known safe domains and prohibiting dangerous protocols such as file://, gopher://, or ftp:// unless absolutely necessary and strictly controlled. Additionally, path traversal sequences should be rejected to prevent access outside the intended web root directory. For existing deployments where patching is not immediately feasible, network-level controls can provide temporary relief by blocking outbound connections from the application server to internal IP ranges that do not require external access, or by restricting file:// protocol usage at the operating system level using security modules like SELinux or AppArmor. Regular code audits focusing on input validation in authentication-related endpoints are essential to prevent similar flaws in other parts of the application logic aligned with MITRE ATT&CK techniques such as T1504 Weak or Unprotected Credentials and T1078 Valid Accounts if exploitation leads to unauthorized session creation.