Unauthenticated SSRF in AVideo Login Endpoint

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a server-side request forgery vulnerability in the _json_decode function that fetches remote URLs and local file paths without SSRF validation. Unauthenticated attackers can POST file paths or HTTP URLs to login.json.php to read local files or access internal services, with results parsed as login credentials.

Casky was already ahead

This CVE exploits attack patterns that Casky's 331matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

WWBN AVideo contains a server-side request forgery (SSRF) vulnerability in its login.json.php endpoint that allows unauthenticated attackers to read arbitrary local files and access internal services. The flaw exists in the _json_decode function, which fetches remote URLs and local file paths without proper validation. Attackers can POST malicious file paths or HTTP URLs to the login endpoint, which are then processed and returned as login credentials. With a CVSS score of 7.2 and no authentication requirement, this vulnerability poses a significant risk to organizations running AVideo installations, potentially exposing sensitive configuration files, credentials, and enabling reconnaissance of internal network services.

Casky's 331 matching skills leverage Claude's extended reasoning to identify the attack patterns associated with this vulnerability across MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Practitioners using Casky would observe detection signals including: suspicious POST requests to login.json.php with file:// or http:// protocols in parameters, unusual response patterns containing file contents or internal service banners, and authentication attempts immediately following SSRF probing. The platform's skills would correlate these indicators with known SSRF exploitation patterns, flag the absence of input validation on URL/path parameters, and identify whether attackers are enumerating local files (passwd, config files) or probing internal services—all hallmarks of the Initial Access and credential harvesting techniques this CVE enables.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

331 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-89242.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Investigate the attack patterns behind CVE-2026-89242

Casky has 331 skills that investigate the attack patterns behind CVE-2026-89242. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn