CVE-2026-89242 WWBN AVideo Unauthenticated SSRF via login.json.php
Unauthenticated attackers can exploit an SSRF vulnerability in AVideo to read local files or access internal services via the login endpoint.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-89242?
CVE-2026-89242 is a medium-severity server-side request forgery vulnerability in WWBN AVideo, published on 11 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.
Weakness: CWE-918
Which versions are affected by CVE-2026-89242?
How do I fix CVE-2026-89242?
No fix has been published for CVE-2026-89242 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-89242 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-89242 exists.
Sources
Also known as GHSA-wp9x-gmrc-2hg3, GHSA-wqwf-wmvx-53jh.