Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-61572— AVideo-Encoder: unauthenticated full-response server-side request forgery

Quick assessment

Affected
WWBN AVideo-Encoder
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

AVideo 是一个视频分享平台。在 8.1.0 版本进行首次修复尝试之前， 中的 函数在仅通过 进行语法校验后，便接受由调用者控制的目的地，且未拒绝私有地址、回环地址或链路本地地址，同时禁用了 TLS 对等方验证。 方法会利用攻击者可设置的 Cookie，结合任意非空的 和 Cookie 进行重新认证，而 方法则将原始获取的响应体存储在 变量中。未经验证的 端点会返回该会话对象，使得攻击者可通过提供的 实现完整响应数据的窃取；其 访问控制机制在操作员白名单为空（默认状态）时允许访问所有站点。因此，未认证的远程攻击

CVSS 8.6 · High
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-61572

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
AVideo-Encoder: unauthenticated full-response server-side request forgery
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after only `FILTER_VALIDATE_URL` syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. `Login::isLogged` reauthenticates using the attacker-settable `encoder_aVideoURL` cookie together with arbitrary nonempty `encoder_user` and `encoder_pass` cookies, and `Login::run` stores the raw fetched body in `result`. The unauthenticated `objects/login.json.php` endpoint returns that session object, enabling full-response exfiltration through a supplied `siteURL`; its `Streamer::isURLAllowed` gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in `view/youtubeDl.json.php` routes an ftp `videoURL` into `FTPDownloader`; `parseFtpUrl` in `objects/FTPDownloader.php` accepts its host and port for `ftp_connect`. This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
WWBN AVideo-Encoder < 8.1.0 -

II. Public POCs for CVE-2026-61572

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-61572

请登录查看更多情报信息。

Other References for CVE-2026-61572 (3)

Same Patch Batch · WWBN · 2026-10-28 · 7 CVEs total

CVE-2026-61567 10.0 CRITICAL AVideo-Encoder: unauthenticated command execution through streamer login trust
CVE-2026-61564 10.0 CRITICAL AVideo-Encoder: unauthenticated installer PHP code injection
CVE-2026-61569 7.5 HIGH AVideo-Encoder: pre-authentication streamer-login SQL injection
CVE-2026-61571 7.3 HIGH AVideo-Encoder: missing authentication on control and status endpoints
CVE-2026-61573 6.1 MEDIUM AVideo-Encoder: reflected cross-site scripting in the login interface
CVE-2026-61575 4.7 MEDIUM AVideo-Encoder vulnerable to stored DOM cross-site scripting through queue titles

IV. Related Vulnerabilities

Same product: AVideo-Encoder
Same vendor: WWBN
Same weakness: CWE-918