SSRF Vulnerability in WWBN AVideo Video Platform

CVE-2026-41055

What is CVE-2026-41055?

WWBN AVideo, an open-source video platform, presents a significant SSRF vulnerability due to an incomplete fix in its LiveLinks proxy. This issue affects versions 29.0 and below, where the implementation of the 'isSSRFSafeURL()' validation does not adequately address DNS TOCTOU vulnerabilities. Consequently, a malicious actor could exploit this flaw by manipulating DNS rebinding to redirect traffic to internal endpoints, potentially exposing sensitive data. An updated fix for this issue can be found in commit 8d8fc0cadb425835b4861036d589abcea4d78ee8.

References