CVE-2026-41060 Details
Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.
A server-side request forgery (SSRF) vulnerability has been identified in WWBN AVideo versions 29.0 and below. The issue arises in the isSSRFSafeURL() function within objects/functions.php, where a same-domain check allows URLs with matching hostnames to bypass SSRF protections. This vulnerability is exploitable by using the site's public hostname with a non-standard port to access arbitrary internal services on the AVideo server. The response from these services is saved to a web-accessible directory, enabling full exfiltration of the data.
Users are advised to update to the patched version of AVideo, where this vulnerability has been addressed by modifying the isSSRFSafeURL() function to ensure that both the hostname and port match the webSiteRootURL.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 22, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba | [email protected] | Patch |
| https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| wwbn avideo | <= 29.0 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | Initial Analysis | [email protected] |
| Apr 22, 2026 | CVE Modified | CISA-ADP |
| Apr 21, 2026 | New CVE Received | [email protected] |