CVE-2026-33039 Details
Description
WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.
A server-side request forgery (SSRF) vulnerability has been identified in the WWBN AVideo platform, specifically in versions through 25.0. The issue resides in the plugin/LiveLinks/proxy.php endpoint, which improperly validates user-supplied URLs against internal networks. While the initial URL is checked for safety, any HTTP redirects are followed without re-validation, allowing attackers to access internal services and metadata through controlled redirects. This vulnerability is present in an unauthenticated endpoint that directly interacts with the user-supplied URLs.
Users are advised to update to AVideo version 26.0 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 20, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw | CISA-ADP | ExploitVendor Advisory |
| https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | < 26.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 23, 2026 | Initial Analysis | [email protected] |
| Mar 20, 2026 | CVE Modified | CISA-ADP |
| Mar 20, 2026 | New CVE Received | [email protected] |