PT-2026-30987 · Avideo · Avideo

Threalwinky · Published 2026-04-07 · Updated 2026-04-08 · CVE-2026-39368

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 26.0 and prior

Description AVideo is an open source video platform. Versions 26.0 and prior are susceptible to a Server-Side Request Forgery (SSRF) issue within the Live restream log callback flow. This flow accepts a restreamerURL controlled by an attacker and subsequently fetches this URL server-side. This enables a stored SSRF, allowing authenticated streamers to trigger requests to loopback or internal HTTP services through the restream log feature. A low-privilege user with streaming permission can store an arbitrary callback URL and initiate server-side requests to internal resources.

Recommendations Update AVideo to a version later than 26.0.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-39368

GHSA-Q4X6-6MM2-CRG9

Affected Products

Avideo

References · 7

• https://osv.dev/vulnerability/GHSA-q4x6-6mm2-crg9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39368 · Security Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-q4x6-6mm2-crg9 · Note
• https://github.com/WWBN/AVideo · Note
• https://reddit.com/r/VulnMatter/comments/1sft88v/resumen_diario_de_vulnerabilidades_08042026 · Reddit Post
• https://twitter.com/CVEnew/status/2041711908852813920 · Twitter Post
• https://twitter.com/infoflowcloud/status/2041714138934546697 · Twitter Post