Server-Side Request Forgery in WWBN AVideo Open Source Video Platform
CVE-2026-33502

9.3CRITICAL

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
23 March 2026

What is CVE-2026-33502?

WWBN AVideo is an open-source video platform that has a vulnerability in its plugin/Live/test.php file. Versions up to and including 26.0 are affected by an unauthenticated server-side request forgery (SSRF), which enables remote attackers to manipulate the AVideo server into sending HTTP requests to arbitrary URLs. This vulnerability grants the potential for attackers to probe internal services and access potentially sensitive localhost resources or cloud metadata endpoints, posing significant security risks for affected installations. A patch has been released to address this issue, detailed in commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3.

Affected Version(s)

AVideo <= 26.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-3...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/1e6cf03e93b5a531820...
x_refsource_MISC

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.