Avideo CVE-2026-41055

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-21 security-advisories@github.com

8.6

CVSS 3.1 · GitHub Advisory

Share

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 8.6

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

Analysis

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

More in Avideo

View all

CVE-2023-48728 CRITICAL Emergency POC

A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.

CVE-2024-31819 CRITICAL Act Now POC

An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath

CVE-2022-30547 CRITICAL Act Now POC

A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit

CVE-2023-49599 CRITICAL Act Now POC

An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed

CVE-2026-28501 CRITICAL Act Now POC

Unauthenticated SQL injection in AVideo before 24.0.

CVE-2023-25313 CRITICAL Act Now POC

OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbit

CVE-2022-26842 CRITICAL Act Now POC

A reflected cross-site scripting (xss) vulnerability exists in the charts tab selection functionality of WWBN AVideo 11.

CVE-2023-47861 CRITICAL Act Now POC

A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and

CVE-2022-28712 CRITICAL Act Now POC

A cross-site scripting (xss) vulnerability exists in the videoAddNew functionality of WWBN AVideo 11.6 and dev master co

CVE-2023-49589 HIGH This Week POC

An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVi

CVE-2023-32073 HIGH This Week POC

WWBN AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable

CVE-2023-30854 HIGH This Week POC

AVideo is an open source video platform. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all

CVE-2021-34473 CRITICAL POC

CVE-2021-26855 CRITICAL POC

CVE-2022-41040 HIGH POC

CVE-2024-21893 HIGH POC

CVE-2023-48022 CRITICAL POC

CVE-2016-3718 MEDIUM POC

CVE-2015-8813 HIGH POC

CVE-2020-24881 CRITICAL POC

Same technique SSRF

View all

CVE-2016-3718 MEDIUM POC

CVE-2015-8813 HIGH POC

CVE-2020-24881 CRITICAL POC

CVE-2026-15409 CRITICAL POC

CVE-2024-54385 HIGH POC

CVE-2022-45835 MEDIUM POC

CVE-2024-54330 HIGH POC

CVE-2026-20230 HIGH POC

Share

CVE-2026-41055 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy