CVE-2026-85164

WWBN AVideo through commit c91b5975d is vulnerable to server-side request forgery (CWE-918) in the set_api_userImages API endpoint, which fetches the user-supplied profileImg and backgroundImg URLs without validating that they point to allowed, non-internal destinations. An attacker holding valid API credentials submits an internal URL — such as a cloud metadata service (e.g., 169.254.169.254) or another internal host — and the AVideo server retrieves it on the attacker's behalf. The fetched content is then written to a publicly accessible web path, so the attacker can read internal responses (including metadata credentials or internal service output) simply by retrieving that file, potentially enabling cloud account takeover or internal network reconnaissance. Risk is concentrated on operators running affected AVideo builds whose API is reachable and who have issued credentials to accounts that could be compromised or abused. No exploitation has been reported: there is no public proof-of-concept, EPSS is 0.2% (15th percentile), and the issue is not in CISA's KEV catalog.

What to do: Restrict the profileImg and backgroundImg inputs to allow-listed public hosts and schemes before the server fetches them, and block server egress to link-local (169.254.169.254) and internal RFC1918 ranges as a compensating control. Audit publicly reachable AVideo upload/output paths for recently written image or metadata files whose contents reference internal endpoints, which would indicate attempted SSRF reads. Track the upstream project for a fixed release and update beyond commit c91b5975d as soon as a patched version is published, since the data lists no fixed version yet.