{"id":"CVE-2026-114634","kind":"vulnerability","aliases":["CVE-2026-114634"],"related":[],"title":"WWBN AVideo: redirect flaw lets uploaders make server send internal requests","description":"WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because get_headers() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.","summary":"WWBN AVideo before 29.4.0 fetches a stored video link to read its content type and follows redirects without rechecking the destination against its SSRF filter. An authenticated uploader can point a video link at a redirector, so the server sends GET requests to internal addresses when visitors view the video, enabling internal port scanning.","severity":"medium","cvss":5.3,"epss":0.00198,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["avideo","package","php","self-hosted"],"not_affected_if":["auth-required","managed-hosting"],"how_to_check":"- Check the installed AVideo version in the project's version file or admin panel; versions below `29.4.0` are affected\n- Review whether untrusted users can upload or edit videos with external video links","fix":"- Upgrade AVideo to `29.4.0` or later\n- Until upgraded, restrict who can upload videos or set external video links","status":"open","published_at":"2026-10-22T02:16:55+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","triaged_at":"2026-10-25T04:20:44+00:00","updated_at":"2026-10-25T04:20:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:20:44Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade AVideo to `29.4.0` or later\n- Until upgraded, restrict who can upload videos or set external video links","reach":"internet","title":"WWBN AVideo: redirect flaw lets uploaders make server send internal requests","impact":"low","summary":"WWBN AVideo before 29.4.0 fetches a stored video link to read its content type and follows redirects without rechecking the destination against its SSRF filter. An authenticated uploader can point a video link at a redirector, so the server sends GET requests to internal addresses when visitors view the video, enabling internal port scanning.","category":"package","nicknames":[],"who_cares":["avideo","self-hosted","php"],"confidence":0.7,"needs_auth":"yes","worst_case":"server makes internal requests, enabling internal port scanning","analyst_note":"","how_to_check":"- Check the installed AVideo version in the project's version file or admin panel; versions below `29.4.0` are affected\n- Review whether untrusted users can upload or edit videos with external video links","needs_analyst":false,"not_affected_if":["managed-hosting","auth-required"],"who_is_affected":"Self-hosted AVideo instances before 29.4.0 where users with upload rights can store external video links. Blind SSRF means the attacker sees little output, so the risk is mainly internal network scanning and reaching services that trust the server's address. Instances that are managed elsewhere or where only trusted staff upload videos carry less risk.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000611,"input_tokens":3399,"output_tokens":542,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114634':14A,17A '-2026':13A,16A '29.4.0':27B,81C 'address':68B 'authent':50B,105C 'avideo':2A,18B,25B,79C 'blind':84C 'caus':115C 'contain':82C 'content':36B 'cve':12A,15A 'destin':44B 'emb':131C 'embed-versus-video':130C 'enabl':74B,124C 'fetch':28B 'filter':48B 'flaw':4A 'follow':39B,96C 'forgeri':89C 'get':64B,94C,117C 'getheadercontenttypefromurl':92C 'header':95C 'host':23B 'intern':10A,67B,75B,116C,125C 'isssrfsafeurl':104C 'let':5A 'link':32B,56B 'make':7A 'oracl':135C 'packag':19B 'php':20B 'point':53B,111C 'port':76B,126C 're':100C 're-valid':99C 'read':34B 'recheck':42B 'redirect':3A,40B,97C 'redirector':59B,114C 'render':134C 'request':11A,65B,88C,118C 'scan':77B,127C 'self':22B 'self-host':21B 'send':9A,63B 'server':8A,62B,86C 'server-sid':85C 'side':87C 'ssrf':47B 'store':30B,108C 'target':102C 'type':37B 'upload':6A,51B,106C 'valid':101C 'versus':132C 'via':128C 'video':31B,55B,73B,123C,133C 'videolink':110C 'view':71B,121C 'visitor':70B,120C 'vulner':90C 'without':41B,98C 'wwbn':1A,24B,78C","nicknames":[],"mitigations":[],"who_affected":"Self-hosted AVideo instances before 29.4.0 where users with upload rights can store external video links. Blind SSRF means the attacker sees little output, so the risk is mainly internal network scanning and reaching services that trust the server's address. Instances that are managed elsewhere or where only trusted staff upload videos carry less risk.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-22T02:16:55+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114634","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114634","severity":null,"published_at":"2026-10-22T02:16:55+00:00","modified_at":"2026-10-23T15:17:27+00:00","first_seen_at":"2026-10-23T21:57:30+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114634","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114634","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:52+00:00","fetched_at":"2026-10-24T07:15:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}