AVideo-Encoder: Unauthenticated server-side request forgery
Summary
AVideo-Encoder before 8.1.0 lets an unauthenticated remote attacker make the server send requests to arbitrary destinations, including private, loopback and link-local addresses, with TLS peer verification disabled. The attacker can read internal HTTP and HTTPS responses, including cloud instance metadata credentials, and reach internal TCP and FTP services. No account or user interaction is required, and the default configuration allows all sites when the allowlist is empty. Version 8.1.0 is only an initial fix; according to the CVE description, the internal-network and TLS variants remain unresolved.
Affected
- WWBN AVideo-Encoder before 8.1.0 (according to the CNA data)
- Note: one tracker (VulDB) lists 'up to 8.0.x' and a different CWE and score; this conflicts with the CVE record and is unverified.
Fixed in
- Version 8.1.0 (initial remediation attempt only)
- No later fixed version is known. The vendor has not confirmed full remediation of the internal-network and TLS variants.
Workaround
- No official workaround is published.
- Set allowPrivateNetworkURLs explicitly to false if the Encoder does not need to reach private-network Streamers (test first).
- Restrict outbound traffic from the Encoder host; block cloud metadata addresses, internal services and outbound FTP unless required.
- Do not expose the Encoder login or admin pages to the internet; use a VPN or IP allowlist.
Exploitation
- CISA SSVC in the CNA record lists exploitation as 'poc' and automatable as 'yes'.
- Other trackers report no confirmed public proof of concept.
- Not listed in the CISA KEV catalog.
- No confirmed in-the-wild exploitation; status unknown.
Our recommendation
- Upgrade to version 8.1.0 at minimum.
- Apply the workarounds above, especially restricting outbound access from the Encoder host.
- If the host runs in a cloud, enable instance metadata hardening and rotate credentials that may have been exposed.
- Review web and firewall logs for requests to internal addresses or metadata endpoints.
- Check the related unauthenticated AVideo-Encoder advisories (installer code injection, command execution) first, as they are more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit 60430ee (fix) github.com
- AVideo-Encoder release v8.1.0 github.com
- GitHub Security Advisory GHSA-cvhm-j9cp-8w59 github.com
- Strix: CVE-2026-61572 www.strix.ai
- OffSeq Radar: CVE-2026-61572 radar.offseq.com
- The Hacker Wire: CVE-2026-61572 www.thehackerwire.com
- VulDB: CVE-2026-61572 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:51.
Original description (NVD)
AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after only `FILTER_VALIDATE_URL` syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. `Login::isLogged` reauthenticates using the attacker-settable `encoder_aVideoURL` cookie together with arbitrary nonempty `encoder_user` and `encoder_pass` cookies, and `Login::run` stores the raw fetched body in `result`. The unauthenticated `objects/login.json.php` endpoint returns that session object, enabling full-response exfiltration through a supplied `siteURL`; its `Streamer::isURLAllowed` gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in `view/youtubeDl.json.php` routes an ftp `videoURL` into `FTPDownloader`; `parseFtpUrl` in `objects/FTPDownloader.php` accepts its host and port for `ftp_connect`. This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.
NVD references (4)
- https://github.com/WWBN/AVideo-Encoder/commit/60430ee18f669798485e81276a1fb6d26b06eb9a
- https://github.com/WWBN/AVideo-Encoder/releases/tag/v8.1.0
- https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-cvhm-j9cp-8w59
- https://github.com/WWBN/AVideo-Encoder/security/advisories/GHSA-cvhm-j9cp-8w59
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.