An authenticated SSRF flaw exists in the video platform, where the aVideoEncoder.json.php endpoint accepts a downloadURL parameter and fetches the target resource on the server without validation. This flaw allows an attacker to compel the server to access arbitrary URLs, including internal network endpoints. The resulting data retrieval can expose sensitive internal APIs, metadata services, or other systems, and may enable further compromise depending on the environment. The weakness corresponds to CWE‑918.

The vulnerability affects all installations of WWBN AVideo versions prior to 22.0. The fix was introduced in release 22.0, so systems running older releases are at risk.

The issue carries a CVSS score of 8.6, indicating high severity. The EPSS score is less than 1%, suggesting a low probability of active exploitation at present, and it is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with access to the API, after which the attacker can invoke the SSRF using any URL. In environments with exposed internal services, this could lead to data leakage or further lateral movement.