CVE-2026-33766: AVideo has SSRF Protection Bypass via HTTP Redirect in Image Download Endpoints

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-27 · updated 2026-10-26
Weakness: CWE-918

Description

WWBN AVideo is an open source video platform. In versions up to and including 26.0, `isSSRFSafeURL()` validates URLs against private/reserved IP ranges before fetching, but `url_get_contents()` follows HTTP redirects without re-validating the redirect target. An attacker can bypass SSRF protection by redirecting from a public URL to an internal target. Commit 8b7e9dad359d5fac69e0cbbb370250e0b284bc12 contains a patch.

Affected products

WWBN AVideo: through 26.0

References

https://github.com/WWBN/AVideo/commit/8b7e9dad359d5fac69e0cbbb370250e0b284bc12
https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf
https://github.com/WWBN/AVideo/security/advisories/GHSA-f359-r3pv-2phf

Get alerted when CVE-2026-33766 or the next vulnerability affects your stack