AVideo has Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
Date: 2026-05
Affected: composer/wwbn/avideo
Attack vector: ssrf
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2026-43879
CWE: CWE-918
CVSS: 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N)

## Summary An authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. `http://127.0.0.1:8080/...`, `http://169.254.169.254/latest/...`, RFC1918 addresses). When any other user (including a second account owned by the same attacker) donates even a trivial amount via `plugin/CustomizeUser/donate.json.php`, the AVideo server issues a `curl` POST to the attacker-supplied URL, resulting in a blind SSRF. The handler uses only `isValidURL()` (which is a format check) and does not call the codebase's own `isSSRFSafeURL()` helper. Additionally, `CURLOPT_FOLLOWLOCATION` is enabled with no per-hop revalidation, so even if the stored URL were validated, an HTTP 307 from an attacker-controlled host could redirect the POST to internal targets. ## Details ### Sink: unvalidated curl POST in afterDonation `plugin/YPTWallet/YPTWallet.php:1043-1099` ```php public function afterDonation($from_users_id, $how_much, $videos_id, $users_id, $extraParameters) { ... $donation_notification_url = self::getDonationNotificationURL($users_id); ... if (!empty($donation_notification_url) && isValidURL($donation_notification_url)) { ... $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $donation_notification_url); curl_setopt($ch, CURLOPT_POST, true); curl_setopt($ch, CURLOPT_POSTFIELDS, $postData); curl_setopt($ch, CURLOPT_RETURNTRANSFER, true); curl_setopt($ch, C


Mitigations:

Architectural layers (MAESTRO):