CVE-2026-41055CWE-918

AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

High · published April 21, 2026

CVSS v3.1
8.6
EPSS
0%
Percentile
37.4
In the wild
Unconfirmed
What it is

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

The record
Technical detail
CVSS v3.1
8.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00442 · 37.4th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-04-21T22:25Z
EPSS history
Timeline
  • 21 APR 22:25Z
    AVideo has an incomplete fix for CVE-2026-33039 (SSRF)
    cvelistv5