CVE-2026-33039

HIGH EPSS 36.1%
Published Mar 20, 20263mo ago · Modified Mar 23, 20263mo ago
8.6 CVSS 3.1
High
Find Similar
Published Mar 20, 2026 3mo ago
Last Modified Mar 23, 2026 3mo ago

Description

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.

CVSS Details

Base Score
8.6
Exploitability
3.9
Impact
4.0
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Changed
Confidentiality High
Integrity None
Availability None

Threat Intelligence

EPSS Exploit Probability
36.1% percentile
Exploit & Patch Status
Public Exploit Known
Patch Available

Weaknesses 1

CWE-918 Server-Side Request Forgery (SSRF) Validation

Affected Products 1

VendorProductVersionRange
wwbnavideo* <26.0

References 2

  • github.com https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917
    Patch
  • github.com https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw
    ExploitVendor Advisory

Remediation

  • github.com https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917
    Patch