Multiple Critical AVideo Flaws Enable Takeover, Session Hijacking, and SSRF

WWBN AVideo was found to contain multiple high-severity vulnerabilities that can let attackers seize control of deployments, hijack user sessions, and access internal network resources. On uninitialized instances running version 25.0 or earlier, install/checkConfiguration.php could be abused without authentication to complete setup, create an administrator account, and write configuration files, enabling full application takeover under CVE-2026-33038. Separate insecure defaults in the official Docker deployment path, tracked as CVE-2026-33037, left new installations exposed to immediate administrative compromise because the admin password defaulted to "password" and database credentials defaulted to avideo/avideo, with no forced password change or effective hardening.

AVideo also exposed users and infrastructure through web-facing flaws in session handling and URL fetching. Under CVE-2026-33043, /objects/phpsessionid.json.php disclosed active PHP session IDs to unauthenticated requests, and permissive CORS behavior could allow cross-origin session theft and account takeover. Two SSRF issues affected the unauthenticated plugin/LiveLinks/proxy.php endpoint: CVE-2026-33039 allowed redirect-based bypass of URL safety checks in version 25.0 and earlier, while CVE-2026-33480 showed that isSSRFSafeURL() could also be bypassed with IPv4-mapped IPv6 addresses, extending exposure through version 26.0 and enabling access to localhost, RFC1918 networks, and cloud metadata services. WWBN issued fixes in AVideo 26.0 for most of the disclosed flaws, with an additional patch published for the IPv6-based SSRF bypass.