WWBN AVideo allows an attacker-controlled restreamer URL to be stored and later fetched server‑side by the restream log feature. The stored URL is requested internally, giving the attacker the ability to reach loopback or other internal HTTP services. This stored Server Side Request Forgery can expose sensitive internal interfaces, leak data, or enable further lateral movement, depending on the internal services reachable by the application.

The vulnerability exists in WWBN AVideo versions 26.0 and earlier. Users running these versions should verify the version and apply the latest release that excludes the vulnerable restream log callback flow.

The CVSS score of 6.5 indicates moderate severity. Exploitation requires the attacker to be an authenticated user with streaming permission, a relatively low privilege level. No publicly known exploits are documented, and the vulnerability is not listed in CISA’s KEV catalog. The attack vector is server‑side request from the application, making it accessible to any authenticated streamer but not to unauthenticated users.