CVE-2026-91966

EUVD-2026-78642
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.8 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
wwbnavideo
𝑥
≤ 29.0
CNA
Common Weakness Enumeration
References
https://github.com/WWBN/AVideo/security/advisories/GHSA-rqg6-qcjv-55w5
https://www.vulncheck.com/advisories/avideo-through-29.0-unauthenticated-ssrf-via-host-header