CVE-2026-39368
Last modified
CVE-2026-39368 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. EPSS estimates a 0.21% chance of exploitation in the next 30 days.
Description
WWBN AVideo is an open source video platform. In versions 26.0 and prior, the Live restream log callback flow accepted an attacker-controlled restreamerURL and later fetched that stored URL server-side, enabling stored SSRF for authenticated streamers. The vulnerable flow allowed a low-privilege user with streaming permission to store an arbitrary callback URL and trigger server-side requests to loopback or internal HTTP services through the restream log feature.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wwbn | Avideo | <= 26.0 |
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-q4x6-6mm2-crg9Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-39368?
How severe is CVE-2026-39368?
How do I fix CVE-2026-39368?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-39362InvenTree is an Open Source Inventory Management System. Pri…7.1
- CVE-2026-39363Vite is a frontend tooling framework for JavaScript. From 6.…7.5
- CVE-2026-39364Vite is a frontend tooling framework for JavaScript. From 7.…7.5
- CVE-2026-39365Vite is a frontend tooling framework for JavaScript. From 6.…5.3
- CVE-2026-39366WWBN AVideo is an open source video platform. In versions 26…6.5
- CVE-2026-39367WWBN AVideo is an open source video platform. In versions 26…5.4
- CVE-2026-39369WWBN AVideo is an open source video platform. In versions 26…7.6
- CVE-2026-3937Incorrect security UI in Downloads in Google Chrome on Andro…6.5
- CVE-2026-39370WWBN AVideo is an open source video platform. In versions 26…7.1
- CVE-2026-39371RedwoodSDK is a server-first React framework. From 1.0.0-bet…8.1
- CVE-2026-39373JWCrypto implements JWK, JWS, and JWE specifications using p…5.3
- CVE-2026-39374Plane is an an open-source project management tool. Prior to…7.7
Are you affected by CVE-2026-39368?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST