CVE-2026-41055

Published: Apr 21, 2026Modified: Jun 17, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

Affected (1)

Products: Wwbn: Avideo

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Wwbn Avideo	Up to 29.0

Related CWEs

Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References (5)

https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917

Source: security-advisories@github.com

Patch

https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8

Source: security-advisories@github.com

Patch

https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp

Source: security-advisories@github.com

ExploitMitigationVendor Advisory

https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw

Source: security-advisories@github.com

Not Applicable

https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitMitigationVendor Advisory

Timeline

No history available yet.