CVE-2026-33480 Details
Description
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.
A server-side request forgery (SSRF) vulnerability has been identified in WWBN AVideo versions through 26.0. The issue arises in the 'isSSRFSafeURL()' function, which can be bypassed using IPv4-mapped IPv6 addresses. The unauthenticated 'plugin/LiveLinks/proxy.php' endpoint relies on this function to validate URLs before fetching them with cURL. However, the IPv4-mapped IPv6 prefix passes all validation checks, allowing attackers to access cloud metadata services, internal networks, and localhost services.
Users are advised to update to the patched version of AVideo, which normalizes IPv4-mapped IPv6 addresses and improves URL validation to block private and reserved IP ranges. The updated validation can be implemented by using PHP's built-in filter options to reject private and reserved addresses.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/commit/75ce8a579a58c9d4c7aafe453fbced002cb8f373 | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-p3gr-g84w-g8hh | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 26.0 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Mar 24, 2026 | Initial Analysis | [email protected] |
| Mar 23, 2026 | New CVE Received | [email protected] |