CVE-2026-41055

EUVD-2026-24529
WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.6 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 7%
Affected Products (NVD)
VendorProductVersion
wwbnavideo
𝑥
≤ 29.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917
https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8
https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp
https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw
https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp