AVideo-Encoder contains a server‑side request forgery flaw that allows an unauthenticated attacker to invoke the login.json.php endpoint with a controlled URL. The application fetches the URL using a relaxed validator that accepts any syntactically valid URL, including private, loopback, and link‑local addresses, and it disables TLS peer verification, so self‑signed certificates are accepted. The raw HTTP or HTTPS response is stored in the session object and returned to the caller, giving the attacker direct access to internal network traffic, cloud instance‑metadata credentials, internal TCP services, and other sensitive data. This reflects a classic CWE‑918 weakness.

The vulnerability is present in the WWBN AVideo‑Encoder platform. All releases prior to 8.1.0 are fully vulnerable. Version 8.1.0 includes an initial remediation that removes raw‑response reflection and adds destination checks, but it still allows internal requests when the operator allow‑list is empty and it does not enforce TLS verification, leaving the described internal‑Network and TLS variants unresolved. The impact applies to anyone running an affected instance of the software.

With a CVSS score of 8.6, the fault is considered high severity. The EPSS score is not available, but the vulnerability is publicly disclosed and can be exploited remotely without authentication, making it highly likely to be targeted. The issue is not yet listed in the CISA KEV catalog. Attackers gain a straightforward launchpad by sending unauthenticated requests to objects/login.json.php or the FTP variant view/youtubeDl.json.php, optionally using self‑signed certs or internal IPs. Because the response is returned unfiltered, sensitive data can be exfiltrated with minimal effort.