What is the CVSS score of CVE-2026-41055?

CVE-2026-41055 has a CVSS 3.1 base score of 8.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WWBN AVideo are affected by CVE-2026-41055?

WWBN AVideo versions 29.0 and below contain an unauthenticated server-side request forgery vulnerability (CVSS 8.6) that enables attackers to access internal network resources, cloud metadata…

How to fix or mitigate CVE-2026-41055?

Within 24 hours, conduct a comprehensive inventory of all WWBN AVideo deployments and document installed versions to identify affected systems. Within 7 days, implement network segmentation to restrict outbound connectivity from AVideo servers to only essential external domains; deploy Web Application Firewall (WAF) rules to block requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254/32); disable the vulnerable LiveLinks proxy plugin (plugin/LiveLinks/proxy.php) if operationally feasible. Within 30 days, monitor WWBN security advisories and establish a patching strategy; plan for upgrade to patched versions immediately upon release; if patched versions are unavailable after 90 days, initiate risk assessment and transition planning to alternative video hosting platforms.

WWBN AVideo CVE-2026-41055

HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-21 security-advisories@github.com

SSRF Avideo

8.6

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.6 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

6.8 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N), but DNS-rebinding TOCTOU needs attacker-controlled TTL=0 DNS and a won race, so AC:H; SSRF to internal resources yields S:C and C:H with no integrity/availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 05:27 vuln.today

Analysis Generated

Jul 24, 2026 - 05:27 vuln.today

CVE Published

Apr 21, 2026 - 23:16 nvd

HIGH 8.6

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

AnalysisAI

Server-side request forgery in WWBN AVideo (versions 29.0 and below) lets remote unauthenticated attackers coerce the LiveLinks proxy (plugin/LiveLinks/proxy.php) into contacting internal-only endpoints, because an incomplete fix for CVE-2026-33039 leaves a DNS time-of-check-to-time-of-use gap. Although isSSRFSafeURL() validates the target, get_headers() and fakeBrowser() resolve DNS again independently, so a DNS-rebinding domain with TTL=0 can return a safe external IP during validation and an internal IP during the actual request, reaching resources like cloud metadata (169.254.169.254) or loopback services. Publicly available exploit code exists (a Python PoC in the GHSA advisory); EPSS is low at 0.03% and it is not listed in CISA KEV.

Technical ContextAI

The affected component is the LiveLinks plugin proxy in AVideo, a PHP-based open-source video streaming/CMS platform (CPE cpe:2.3:a:wwbn:avideo). proxy.php fetches remote live-stream URLs on behalf of the server; the prior fix added an isSSRFSafeURL() allow/deny check plus follow_location=0 and max_redirects=0 in the get_headers() stream context. The root cause is CWE-918 (Server-Side Request Forgery) compounded by a TOCTOU race: name resolution performed during validation is not reused for the subsequent outbound request, so the two resolutions can differ. The advisory notes two additional weaknesses - even with follow_location=0, get_headers() still emits an HTTP request usable to probe internal services, and a response carrying multiple Location headers makes filter_var() receive an array instead of a string, causing a fall-through in the redirect-handling logic.

RemediationAI

Upstream fix available (PR/commit); released patched version not independently confirmed - no tagged release version is provided in the source data (fixed-in: None). Update AVideo to a build that includes commits 0e56382921fc71e64829cd1ec35f04e338c70917 and 8d8fc0cadb425835b4861036d589abcea4d78ee8 (https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 and https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8), as referenced in GHSA-793q-xgj6-7frp. Because the residual risk is DNS-rebinding TOCTOU, code-level patching that pins the validated IP for the actual connection is the real fix; compensating controls until then include disabling the LiveLinks plugin/proxy.php endpoint if the proxy feature is not used (trade-off: breaks live-link proxying), restricting the AVideo server's outbound egress via firewall/proxy so it cannot reach RFC1918 ranges, 127.0.0.0/8, and cloud metadata 169.254.169.254 (trade-off: may block legitimate internal stream sources), and enforcing egress DNS controls or a resolver that rejects TTL=0/rebinding responses (trade-off: operational tuning and possible false positives). Restrict access to the proxy endpoint to authenticated/trusted users where deployment allows.