CVE-2026-114634 Details

A blind server-side request forgery (SSRF) vulnerability has been identified in WWBN AVideo versions prior to 29.4.0. The issue arises in the function getHeaderContentTypeFromURL(), where the PHP function get_headers() follows redirects without re-validating the target URLs for safety. This vulnerability allows authenticated uploaders to store video links that point to redirectors, which can then be exploited to make internal GET requests when the video is viewed. This exploitation can facilitate internal port scanning by using the video's embed rendering as an oracle to determine the response from scanned ports.

Users can update to WWBN AVideo version 29.4.0 or later, where this vulnerability has been fixed. The patch involves disabling automatic redirect following in the getHeaderContentTypeFromURL() function, manually validating each redirect with isSSRFSafeURL(), and using a hardened fetch method that rechecks redirects before following them.