Vulnerability details
CVE-2026-33039
WWBN AVideo
AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
CVSS 3.1
8.6High
Official description
WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.6High | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| WWBN | AVideo | < 26.0 | CVEProject cvelistV5 (CNA) |
References and advisories
2- https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 x_refsource_MISC
- https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-03-20
- Last updated
- 2026-03-20
- State
- Published
- Assigner (CNA)
- GitHub_M
Exploit prediction (EPSS)
0.47%
Probability of exploitation in 30 days
40.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-918Server-Side Request Forgery (SSRF)