Live › vulnerability › CVE-2026-114634
Go to dashboardWWBN AVideo before 29.4.0 fetches a stored video link to read its content type and follows redirects without rechecking the destination against its SSRF filter. An authenticated uploader can point a video link at a redirector, so the server sends GET requests to internal addresses when visitors view the video, enabling internal port scanning.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Self-hosted AVideo instances before 29.4.0 where users with upload rights can store external video links. Blind SSRF means the attacker sees little output, so the risk is mainly internal network scanning and reaching services that trust the server's address. Instances that are managed elsewhere or where only trusted staff upload videos carry less risk.
No product ranges from the sources yet.
29.4.0 are affected29.4.0 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.
This page as .md · .json · in your agent: get_signal("CVE-2026-114634")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.