The Scheduler plugin’s run() function performs an HTTP request to an admin‑configurable callbackURL using url_get_contents. Only the URL format is validated, and the function is not protected against server‑side request forgery. An authenticated administrator can set the callbackURL to an internal network address or a cloud metadata endpoint, enabling the platform to retrieve information or perform actions on hosts that are otherwise unreachable from the internet. This gives an attacker the ability to obtain sensitive data, exfiltrate internal information, or interact with internal services, potentially leading to privilege escalation or data compromise.

The vulnerability affects the WWBN AVideo open‑source video platform. Versions prior to 26.0 are vulnerable. Version 26.0 includes a patch that ensures the callbackURL is evaluated by isSSRFSafeURL(), blocking RFC‑1918 addresses, loopback, and cloud metadata services. Users running earlier releases should upgrade or disable the Scheduler plugin.

The CVSS score is 5.5, reflecting a moderate risk. EPSS is below 1 %, indicating a low probability of recent exploitation. It is not listed in the CISA KEV catalog. Exploitation requires administrative control over the Scheduler plugin, meaning the attacker would need to authenticate as an administrator or gain control over scheduled tasks. With such access, the attacker could introduce arbitrary callbackURLs to perform SSRF against internal hosts or cloud metadata endpoints. The attack vector is limited to privileged users, but the impact on internal resources can be significant if unmitigated.