← Back to CVEs

CVE-2026-41055

HIGH

8.6

Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

CVE Details

CVSS v3.1 Score8.6

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published4/21/2026

Last Modified4/23/2026

Sourcenvd

Honeypot Sightings0

Affected Products

wwbn:avideo

Weaknesses (CWE)

CWE-918

References

https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917(security-advisories@github.com)

https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8(security-advisories@github.com)

https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp(security-advisories@github.com)

https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw(security-advisories@github.com)

https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.