NIST deprecates RSA-2048 from 2030. Find every one of them before attackers do.
🐘
🐘 Packagist
Not in CISA KEV
MEDIUM severity

WWBN AVideo has a Live restream log callback flow enabling stored SSRF to internal servicesGHSA-q4x6-6mm2-crg9

MEDIUM

GHSA-q4x6-6mm2-crg9 is a medium-severity (CVSS 6.5) Server-Side Request Forgery (SSRF) vulnerability in WWBN/AVideo. The records list no fixed version yet; check the vendor advisory below and apply the mitigations in the meantime.

Also known asCVE-2026-39368
Published
Updated
Affected
1 pkg
Patched
See advisory
Exploits
None indexed
Exploitation data as of Nov 10, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

Proof-of-concept exploit code exists

  • CISA’s SSVC triage found public proof-of-concept exploit code for this CVE, though no confirmed active exploitation.

Exploitation and automatability from CISA’s SSVC triage for GHSA-q4x6-6mm2-crg9.

EPSS Exploitation Probability

via FIRST.org ↗
0.2%probability of exploitation in next 30 days
Lower Risk+0.01%
Lower risk than most CVEs12th percentile — riskier than 12% of all scored CVEsHighest risk
0.00%0.28%0.56%0.84%0.0%0.2%May 26Sep 26Nov 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

Where this sits among everything scored

Real-World Exposure

1 pkg affected
🐘WWBN/AVideo

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

Summary

The Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers.

The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.

Details

The vulnerable chain was:

  1. plugin/Live/view/getRestream.json.php exposed a fresh tokenForAction
  2. plugin/Live/view/Live_restreams/verifyTokenForAction.json.php exchanged it for a valid responseToken
  3. plugin/Live/view/Live_restreams_logs/add.json.php accepted attacker-controlled restreamerURL
  4. plugin/Live/view/getRestream.json.php and plugin/Live/view/Live_restreams/getAction.json.php later fetched that stored URL server-side

The original issue existed because the responseToken was accepted, but the callback destination was not tightly constrained to trusted restreamer endpoints.

The maintainer confirmed the vulnerability and stated that the fix was applied by validating restreamerURL at storage time and re-validating the log-entry branch before use. The maintainer also noted that the m3u8 field follows the same general pattern but is not server-fetched in the current flow.

Proof of concept

  1. Log in as a non-admin user with streaming permission.
  2. Create a normal restream destination.
  3. Trigger plugin/Live/view/Live_restreams/testRestreamer.json.php to create a live transmission history row.
  4. Call:
GET /plugin/Live/view/getRestream.json.php?live_transmitions_history_id=<id>&restreams_id=<id>
  1. Extract tokenForAction from the returned URL.
  2. Exchange it for responseToken via:
POST /plugin/Live/view/Live_restreams/verifyTokenForAction.json.php
  1. Store a loopback callback URL:
POST /plugin/Live/view/Live_restreams_logs/add.json.php
restreamerURL=http://127.0.0.1:9999/index.php
  1. Trigger getRestream.json.php again.
  2. Observe that the returned response now contains the JSON body from the loopback-only service.

Impact

An authenticated streamer can cause the AVideo server to send HTTP requests to loopback or internal services and return the response through normal application endpoints by storing a malicious restreamerURL in the restream log flow. Because the callback destination was not constrained to trusted restreamer endpoints, the application could be used as a proxy to internal-only services that trust network locality. Successful exploitation can expose local admin panels, internal-only APIs, cloud metadata services if reachable, or other sensitive internal responses available from the application host.

Recommended fix

  • Validate restreamerURL against explicitly configured restreamer endpoints at storage time
  • Re-validate the stored callback URL before server-side fetch
  • Bind responseToken to the expected restream row and callback host
  • Apply SSRF validation to the initial destination of every server-side fetch, not only redirect targets
  • Ignore or reject user-supplied callback hosts that do not match trusted configuration

Affected Packages

1 total
EcosystemPackageVulnerable rangeFix
🐘PackagistWWBN/AVideoall versionsNo fix

Affected Products

1 product · 1 configurations
Application
avideowwbn
≤ 26.0
range

Detection & mitigation playbook

Open-source dependency

  1. Detect

    Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for WWBN/AVideo, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

  2. Remediation status

    The records we use list no patched version of WWBN/AVideo for GHSA-q4x6-6mm2-crg9. Check the maintainer's advisory, and where your build allows, override or pin the dependency away from the vulnerable range.

  3. Mitigate without a patch

    Restrict outbound requests from the affected component to an allowlist of hosts, block access to link-local and internal address ranges at the network layer, and require authentication on internal services so a forged request cannot reach them unauthenticated.

Frequently Asked Questions

## Summary The Live restream log callback flow accepted an attacker-controlled `restreamerURL` and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature. ## Details The vulnerable chain was: 1. `plugin/Live/view/getRestream.json.php` exposed a fresh `tokenForAction` 2. `plugin/Live/view/Live_restreams/verifyTokenForAction.json.php` exchange
O3 Security · Impact-Aware SCA

Is GHSA-q4x6-6mm2-crg9 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works
WWBN AVideo has a Live restream log callback flow…