Home / Vulnerability Intelligence / CVE-2026-27732

CVE-2026-27732 - Vulnerability Analysis

HighCVSS: 8.1

Last Updated: February 25, 2026

WWBN AVideo - Server Side Request Forgery

Published: February 24, 2026Updated: February 25, 2026Remote Exploitable

Overview

WWBN AVideo < 22.0 contains a server side request forgery caused by lack of validation on the downloadURL parameter in aVideoEncoder.json.php API endpoint, letting authenticated attackers interact with internal services, exploit requires authentication.

Severity & Score

Severity: High

CVSS Score: 8.1

EPSS Score: 2.8%(Probability of exploitation in next 30 days)

Impact

Authenticated attackers can interact with internal services and retrieve sensitive data, potentially leading to further compromise.

Mitigation

Update to version 22.0 or later.

References

Social Media Activity(2 posts)

TheHackerWire

@thehackerwire

Feb 25, 2026

🟠 CVE-2026-27732 - High (8.1) WWBN AVideo is an open source video platform. Prior to version 22.0, the `aVideoEncoder.json.php` API endpoint accepts a `downloadURL` parameter and fetches the referenced resource server-side without proper validation or an allow-list. This allow... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-27732/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

TheHackerWire

@thehackerwire

Feb 25, 2026

View original post

Related Resources

Details

CVE ID: CVE-2026-27732
Severity: High
CVSS Score: 8.1
Type: server_side_request_forgery
Status: confirmed
EPSS: 2.8%
Social Posts: 2

CWE

CWE-918

CVSS Metrics

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

EPSS Score

2.8%Probability of exploitation in the next 30 days