AVideo contains an authentication‑less SSRF flaw in the Live plugin’s saveDVR.json.php file. The webSiteRootURL request parameter is concatenated directly into a file_get_contents call without any validation or allowlisting. This allows an attacker to cause the server to fetch any HTTP or HTTPS URL, providing a path for data exfiltration, internal network reconnaissance, or the ability to reach services behind firewalls. The vulnerability also lets the attacker bypass verification steps inherent to the platform, potentially enabling further privilege escalation or content manipulation.

The issue affects all WWBN AVideo installations running any version prior to 26.0 when the Live plugin is deployed in its standalone configuration. Version 26.0 incorporates a patch that mitigates the SSRF by correctly validating the webSiteRootURL parameter and implementing proper origin checks.

The CVSS base score of 9.1 indicates a high‑severity flaw. Because no authentication is required and the server is instructed to fetch arbitrary URLs, exploitation is straightforward for anyone able to reach the vulnerable endpoint. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the combination of a high CVSS, lack of safeguards, and the public nature of the code base suggests a high likelihood of exploitation in the wild. Attackers can initiate requests simply by submitting a crafted webSiteRootURL value to the saveDVR.json.php endpoint, making the vulnerability readily exploitable.