{"id":"CVE-2026-61572","kind":"vulnerability","aliases":["CVE-2026-61572"],"related":[],"title":"AVideo: unauthenticated SSRF reads internal responses and cloud metadata credentials","description":"AVideo is a video-sharing Platform. Before the initial remediation attempt in 8.1.0, `url_get_contents` in `objects/functions.php` accepts caller-controlled destinations after only `FILTER_VALIDATE_URL` syntax validation, without rejecting private, loopback, or link-local addresses, and disables TLS peer verification. `Login::isLogged` reauthenticates using the attacker-settable `encoder_aVideoURL` cookie together with arbitrary nonempty `encoder_user` and `encoder_pass` cookies, and `Login::run` stores the raw fetched body in `result`. The unauthenticated `objects/login.json.php` endpoint returns that session object, enabling full-response exfiltration through a supplied `siteURL`; its `Streamer::isURLAllowed` gate allows all sites when the operator allowlist is empty, the default. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP services. A further pre-authentication FTP variant in `view/youtubeDl.json.php` routes an ftp `videoURL` into `FTPDownloader`; `parseFtpUrl` in `objects/FTPDownloader.php` accepts its host and port for `ftp_connect`. This also enables requests to internal FTP services. Untrusted self-signed HTTPS certificates are accepted, and no account or operator interaction is required. Version 8.1.0 contains an initial remediation attempt that removes raw-response reflection and adds destination checks, but private-network exemptions and login TLS-verification defaults leave complete remediation of the described internal-network and TLS variants unresolved.","summary":"AVideo's URL fetch helper accepts private, loopback and link-local destinations and skips TLS verification, and an unauthenticated login endpoint returns the fetched response body. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP and FTP services.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cloud","package","php","self-hosted","video-platform"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the AVideo version: versions before `8.1.0` are affected, and the sources say `8.1.0` only partly fixes the issue.\n- Check whether `Streamer::isURLAllowed` has an operator allowlist configured; the sources say an empty allowlist, the default, allows all sites.\n- Check whether `objects/login.json.php` is reachable from the internet.","fix":"- Upgrade AVideo past `8.1.0`, since the sources say that version only partly remediates the issue; the sources do not name a fully fixed version.\n- Restrict outbound requests from the AVideo host to internal networks and cloud metadata addresses at the network layer.\n- Set an explicit operator allowlist for `Streamer::isURLAllowed`.\n- Block unauthenticated access to `objects/login.json.php` and `view/youtubeDl.json.php` until patched.","status":"open","published_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","triaged_at":"2026-10-28T22:36:37+00:00","updated_at":"2026-10-28T22:36:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T22:36:37Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo past `8.1.0`, since the sources say that version only partly remediates the issue; the sources do not name a fully fixed version.\n- Restrict outbound requests from the AVideo host to internal networks and cloud metadata addresses at the network layer.\n- Set an explicit operator allowlist for `Streamer::isURLAllowed`.\n- Block unauthenticated access to `objects/login.json.php` and `view/youtubeDl.json.php` until patched.","reach":"internet","title":"AVideo: unauthenticated SSRF reads internal responses and cloud metadata credentials","impact":"high","summary":"AVideo's URL fetch helper accepts private, loopback and link-local destinations and skips TLS verification, and an unauthenticated login endpoint returns the fetched response body. An unauthenticated remote attacker can read internal HTTP and HTTPS responses, including cloud instance-metadata credentials, and reach internal TCP and FTP services.","category":"package","nicknames":[],"who_cares":["self-hosted","php","video-platform","cloud"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads cloud metadata credentials and reaches internal services","analyst_note":"Confirm the fixed version after 8.1.0 and whether the FTP variant is patched, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-61572.","how_to_check":"- Check the AVideo version: versions before `8.1.0` are affected, and the sources say `8.1.0` only partly fixes the issue.\n- Check whether `Streamer::isURLAllowed` has an operator allowlist configured; the sources say an empty allowlist, the default, allows all sites.\n- Check whether `objects/login.json.php` is reachable from the internet.","needs_analyst":true,"not_affected_if":["auth-required","managed-hosting"],"who_is_affected":"AVideo installations reachable from the internet, especially those on cloud hosts where instance-metadata endpoints are reachable from the application server. The sources say the default empty allowlist lets any site be requested, so default configurations are exposed. Operators who do not run AVideo can skip it.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000774,"input_tokens":3764,"output_tokens":796,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-61572':13A,16A '8.1.0':90C,258C 'accept':31B,96C,225C,248C 'account':251C 'add':271C 'address':116C 'allow':174C 'allowlist':180C 'also':234C 'arbitrari':135C 'attack':56B,128C,188C 'attacker-sett':127C 'attempt':88C,263C 'authent':211C 'avideo':1A,26B,77C 'avideourl':131C 'bodi':52B,150C 'caller':98C 'caller-control':97C 'certif':246C 'check':273C 'cloud':8A,17B,65B,197C 'complet':286C 'connect':232C 'contain':259C 'content':93C 'control':99C 'cooki':132C,142C 'credenti':10A,69B,201C 'cve':11A,14A 'default':184C,284C 'describ':290C 'destin':38B,100C,272C 'disabl':118C 'empti':182C 'enabl':161C,235C 'encod':130C,137C,140C 'endpoint':47B,156C 'exempt':278C 'exfiltr':165C 'fetch':29B,50B,149C 'filter':103C 'ftp':75B,212C,218C,231C,239C 'ftpdownload':221C 'full':163C 'full-respons':162C 'gate':173C 'get':92C 'helper':30B 'host':22B,227C 'http':60B,192C 'https':62B,194C,245C 'includ':64B,196C 'initi':86C,261C 'instanc':67B,199C 'instance-metadata':66B,198C 'interact':254C 'intern':5A,59B,72B,191C,204C,238C,292C 'internal-network':291C 'islog':123C 'isurlallow':172C 'leav':285C 'link':36B,114C 'link-loc':35B,113C 'local':37B,115C 'login':46B,122C,144C,280C 'loopback':33B,111C 'metadata':9A,68B,200C 'network':277C,293C 'nonempti':136C 'object':160C 'objects/ftpdownloader.php':224C 'objects/functions.php':95C 'objects/login.json.php':155C 'oper':179C,253C 'packag':18B 'parseftpurl':222C 'pass':141C 'peer':120C 'php':19B 'platform':25B,83C 'port':229C 'pre':210C 'pre-authent':209C 'privat':32B,110C,276C 'private-network':275C 'raw':148C,267C 'raw-respons':266C 'reach':71B,203C 'read':4A,58B,190C 'reauthent':124C 'reflect':269C 'reject':109C 'remedi':87C,262C,287C 'remot':55B,187C 'remov':265C 'request':236C 'requir':256C 'respons':6A,51B,63B,164C,195C,268C 'result':152C 'return':48B,157C 'rout':216C 'run':145C 'self':21B,243C 'self-host':20B 'self-sign':242C 'servic':76B,206C,240C 'session':159C 'settabl':129C 'share':82C 'sign':244C 'site':176C 'siteurl':169C 'skip':40B 'ssrf':3A 'store':146C 'streamer':171C 'suppli':168C 'syntax':106C 'tcp':73B,205C 'tls':41B,119C,282C,295C 'tls-verif':281C 'togeth':133C 'unauthent':2A,45B,54B,154C,186C 'unresolv':297C 'untrust':241C 'url':28B,91C,105C 'use':125C 'user':138C 'valid':104C,107C 'variant':213C,296C 'verif':42B,121C,283C 'version':257C 'video':24B,81C 'video-platform':23B 'video-shar':80C 'videourl':219C 'view/youtubedl.json.php':215C 'without':108C","nicknames":[],"mitigations":[],"who_affected":"AVideo installations reachable from the internet, especially those on cloud hosts where instance-metadata endpoints are reachable from the application server. The sources say the default empty allowlist lets any site be requested, so default configurations are exposed. Operators who do not run AVideo can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T22:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-61572","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-61572","severity":null,"published_at":"2026-10-28T22:17:16+00:00","modified_at":"2026-10-28T22:17:16+00:00","first_seen_at":"2026-10-28T22:35:35+00:00","fetched_at":"2026-10-28T22:35:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}