CVE-2026-33039CWE-918

AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

High · published March 20, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
40.3
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00478 · 40.3th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-20T05:38Z
EPSS history
Timeline
  • 20 MAR 05:38Z
    AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy
    cvelistv5