Dashboard / CVE-2026-56342

CVE-2026-56342

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 57/100
Published: 2026-06-20 Modified: 2026-11-08 First seen: 2026-11-08 Status: active

Attack Surface

Network Low Complexity No Interaction

CVSS Vector Breakdown

AV: Network
AC: Low
PR: High
UI: None
AT: None
VC: None
VI: None
VA: None

Description

AVideo through version 27.0 contains a server-side request forgery vulnerability in plugin/Live/test.php that allows authenticated administrators to read arbitrary URLs via the statsURL parameter, which lacks isSSRFSafeURL() validation and accepts requests to private IP ranges and cloud metadata endpoints. Attackers can exploit this by crafting requests to internal services, cloud metadata endpoints like 169.254.169.254, and localhost to retrieve sensitive information including IAM credentials, internal service responses, and network configuration details.

Weakness Classification (1)

Affected Software (1)

VendorProductVersion
AVideo AVideo 0

References & Advisories (2)

Bug Bounty Relevance

57 / 100
✓ Network accessible
✓ Low complexity
✓ No user interaction

CVSS Score

6.1 / 10.0 v4.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

EPSS — Exploitation Probability

0.39%
Raw Score 0.003910
Percentile 33.8%
Date 2026-11-13

EPSS Trend

2026-11-13
0.00391
2026-11-12
0.00391
2026-11-10
0.00391
2026-11-09
0.00391
2026-11-08
0.00391

Intelligence Sources

mitre ref →

External Links