Blind Server-Side Request Forgery in WWBN AVideo Product

CVE-2026-114634

What is CVE-2026-114634?

The WWBN AVideo software before version 29.4.0 is susceptible to a blind server-side request forgery (SSRF) vulnerability in the method getHeaderContentTypeFromURL(). This flaw arises because the get_headers() function does not validate redirected URLs with isSSRFSafeURL(), allowing authenticated users to upload malicious content that points to a redirector. Consequently, this enables the potential exploitation of internal GET requests when videos are accessed, which can inadvertently facilitate internal port scanning and expose sensitive information. It is highly recommended that users update to the latest version to mitigate this vulnerability.

References