AVideo vulnerabilities

AVideo is an open source video platform that is vulnerable to SSRF attacks in versions up to 29.0. Two endpoints improperly validate user-supplied URLs, allowing an attacker to redirect to internal resources.

AVideo is an open-source video platform that, in versions up to 29.0, exposes the local CloneSite shared secret in the HTTP response to every unauthenticated request. This secret can be exploited by an attacker to impersonate the victim and gain access to the remote database.

AVideo is an open-source video platform that has a vulnerability in versions up to 29.0 allowing an unauthenticated attacker to send malicious messages via WebSocket. This vulnerability arises from improper JSON data handling, enabling PHP code execution on the server.

AVideo has an unauthenticated arbitrary file write vulnerability in the aVideoEncoderChunk.json.php endpoint, allowing remote attackers to write up to 4 GB of arbitrary content via HTTP PUT without authentication.

AVideo before 29.0 contains an incomplete fix for CVE-2026-45578. execAsync() re-wraps escaped commands in double-quoted sh -c, allowing command substitution via $() and backticks. Attackers can inject arbitrary OS commands through the Live plugin on_publish.php endpoint despite escapeshellarg() protection.

WWBN AVideo before version 29.0 contains a stored DOM Cross-Site Scripting vulnerability in the YPTSocket plugin. An unauthenticated remote attacker can execute arbitrary JavaScript in the context of an administrator viewing the online users debug panel.

AVideo versions 14.3.1 prior to 20.1 contain an unauthenticated remote code execution vulnerability caused by predictable generation of an installation salt using PHP uniqid(). The installation timestamp is exposed via a public endpoint, and a derived hash identifier is accessible through unauthenticated API responses, allowing attackers to brute-force the remaining entropy. The recovered salt can then be used to encrypt a malicious payload supplied to a notification API endpoint that evaluates attacker-controlled input, resulting in arbitrary code execution as the web server user.

AVideo versions prior to 20.1 with the ImageGallery plugin enabled is vulnerable to unauthenticated file upload and deletion. Plugin endpoints responsible for managing gallery images fail to enforce authentication checks and do not validate ownership, allowing unauthenticated attackers to upload or delete images associated with any image-based video.

WWBN AVideo through 30.0 (and master up to commit 4cb576e) contains a cross-site request forgery vulnerability in plugin/Live/myLiveControls.save.json.php. The endpoint only checks that a user is logged in and processes customUrl, customMessage, and autoRedirect parameters from $_REQUEST via a GET request without enforcing a CSRF token or origin check. An attacker who lures a logged-in streamer to a malicious page can silently change the live-channel viewer-redirect settings, causing viewers to be redirected to a phishing site or shown a spoofed message.

WWBN AVideo through version 30.0 fails to enforce authentication on the report4.json.php and report4.1.json.php endpoints, allowing unauthenticated access to user registration statistics. Attackers can send GET requests to these endpoints to retrieve daily and cumulative user-registration counts without any session or authorization.

AVideo before version 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints.

AVideo through commit 9c39d8c8 contains an authentication bypass vulnerability where deduplicateByEncoderQueueId() returns video_id_hash credentials for any video by encoder_queue_id without ownership verification, and useVideoHashOrLogin() converts this hash into passwordless login as the video owner. Attackers with upload permission can retrieve an administrator's video_id_hash by omitting the videos_id parameter, then use that hash in an unauthenticated request to gain administrative session access and modify system configuration.

WWBN AVideo through commit 9c39d8c8 contains an authorization bypass vulnerability where getToken() creates tokens without binding to user identity or purpose, and plugin/Gallery/view/sections.php issues valid tokens to unauthenticated visitors. Attackers can retrieve a token from the Gallery endpoint and use it to bypass authorization checks in other subsystems like view/hls.php to access restricted video content.

WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the releaseVideoNow.json.php endpoint that lacks authenticity checks and accepts GET requests. Attackers can craft a malicious cross-site GET request carrying an administrator's session cookie to permanently publish any embargoed video by manipulating the videos_id parameter.

WWBN AVideo up to commit 9c39d8c8 contains an authorization bypass vulnerability in the Users_affiliations add.json.php endpoint that allows authenticated users to forge two-party consent records by supplying the counterparty's agreement timestamp. Attackers can create a forged affiliation with status='a' and then reassign video ownership to arbitrary users through the videoAddNew.json.php endpoint, which trusts the forged affiliation as an authorization term.

WWBN AVideo up to commit 9c39d8c8 contains a cross-site request forgery vulnerability in objects/videoEditLight.php that lacks request authenticity checks and accepts GET requests. Attackers can store an img tag in a video description that transfers video ownership to an attacker-controlled account when an administrator views the video page.

AVideo up to commit 9c39d8c8 contains a cross-site request forgery vulnerability in channelToGallery.json.php that allows attackers to modify site-wide Gallery configuration by performing unauthorized writes to plugin data. Attackers can craft a cross-site GET request carrying an administrator's session cookie to promote arbitrary channels to the front page or delete curated sections without token validation.

AVideo up to commit 9c39d8c8 contains an information exposure vulnerability in feed/index.php that allows unauthenticated attackers to retrieve channel owner email addresses by supplying a public channel name parameter. Attackers can enumerate all creator email addresses by iterating through public channel names and extract them from the itunes:email and itunes:author RSS elements, enabling account takeover attempts and phishing campaigns.

AVideo fails to sanitize the phone field during user registration, allowing unauthenticated attackers to inject malicious JavaScript that persists in the database. When administrators visit the users management page, the unsanitized phone value is rendered via innerHTML, executing the injected script in the admin's browser session.

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

WWBN AVideo is an open source video platform. Versions prior to 29.0 expose .env files to unauthenticated users through the official Docker compose configuration. The .env file contains database credentials, admin passwords, and infrastructure configuration, and is served as a static file at /.env.

AVideo through version 29.0 contains an OS command injection vulnerability in the ffmpeg.json.php endpoint. The notifyCode and callback parameters are concatenated into a shell command without escaping, allowing attackers to execute arbitrary OS commands as the web-server user.

In AVideo up to version 29.0, the listFFmpegProcesses() function in plugin/API/standAlone/functions.php interpolates unsanitized keyword parameters inside single quotes without escaping. Attackers who can craft a valid encrypted codeToExec payload can break out of the single-quoted grep context and execute arbitrary OS commands as the web-server user.

Stored Cross-Site Scripting (XSS) vulnerability in the YouTubeAPI plugin of AVideo (versions 29.0 and below). An attacker can inject malicious JavaScript by setting a YouTube video title, which is then rendered on the AVideo homepage without HTML encoding.

AVideo prior to version 29.0 contains an unauthenticated Reflected XSS vulnerability in YouTubeAPI Gallery Pagination. The $_GET['search'] parameter is concatenated directly into the href attribute of pagination links without proper encoding, allowing arbitrary JavaScript injection.

WWBN AVideo versions 29.0 and below contain a Stored XSS vulnerability in the MessageSQLite WebSocket handler. An attacker can bypass sanitization by placing the payload in the 'json' key instead of 'msg', allowing arbitrary JavaScript execution in other users' browsers.

A stored XSS vulnerability in AVideo (Meet plugin) allows an attacker to inject malicious JavaScript via the User-Agent header when joining a public meeting. The payload is stored and later executed in the admin or host's browser session when viewing the participant list.

AVideo through version 25.0 contains an authentication bypass vulnerability in the decryptMessage.json.php endpoint that allows unauthenticated users to decrypt PGP messages. Remote attackers can submit private keys, ciphertext, and passphrases to perform server-side decryption without credentials, exposing key material to logs and enabling resource exhaustion attacks.

AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter. The lack of isSSRFSafeURL() validation enables requests to private IP ranges and cloud metadata endpoints.

AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records.

In AVideo 29.0 and earlier, there is a classic shell-metacharacter injection. The YPTSocket notification branch in plugin/Live/on_publish.php builds an execAsync() command line by string concatenation, single-quoting each argument but never calling escapeshellarg(). A ' in any of the three interpolated values ($users_id, $m3u8, $obj->liveTransmitionHistory_id) closes the quoted token and lets the attacker append arbitrary commands.

In WWBN AVideo up to version 26.0, the file objects/aVideoEncoderReceiveImage.json.php allowed an authenticated uploader to fetch attacker-controlled same-origin /videos/... URLs, bypass traversal scrubbing, and expose server-local files through the GIF poster storage path. The vulnerable GIF branch could be abused to read local files such as /etc/passwd or application source files and republish those bytes through a normal public GIF media URL.

WWBN AVideo, an open-source video platform, has a Server-Side Request Forgery (SSRF) vulnerability in the Live restream log callback flow. An authenticated streamer can store an arbitrary callback URL that is later fetched server-side. This affects versions 26.0 and prior.

AVideo is an open source video platform where the EPG feature parses XML from user-controlled URLs and renders programme titles directly into HTML without sanitization. A user with upload permission can set a malicious XML file with JavaScript in <title> elements. This affects versions 26.0 and prior.

WWBN AVideo versions 26.0 and prior have a vulnerability in the PayPal IPN v1 handler that lacks transaction deduplication. An attacker can replay a single IPN notification to repeatedly inflate wallet balance and renew subscriptions.

A vulnerability was found in AVideo version 26.0 and earlier in the install/deleteSystemdPrivate.php script. Due to a PHP operator precedence bug, the condition !php_sapi_name() === 'cli' always evaluates to false, allowing remote unauthenticated access to the script, which deletes files from the temp directory and discloses its contents.