Blind SSRF Vulnerability in WWBN AVideo Platform Affects Users
CVE-2026-43879

5.4MEDIUM

Key Information:

Vendor

Wwbn

Status
Avideo
Vendor
CVE Published:
11 May 2026

What is CVE-2026-43879?

The WWBN AVideo is an open-source video platform that has a notable vulnerability allowing authenticated users to exploit the donation-notification webhook URL settings. Users can redirect these URLs to internal metadata hosts or loopback addresses, steering server requests to potentially harmful endpoints. This results in a blind Server-Side Request Forgery (SSRF) vulnerability due to insufficient URL validation. The vulnerability arises because the handler merely checks the format of the URL without assessing its safety against possible SSRF attacks. This oversight can expose the server to unintentional disclosure of sensitive internal resources when donations are made, leading to significant security implications. A patch has been introduced in commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9 to address this issue.

Affected Version(s)

AVideo <= 29.0

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-w...
x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/aaacd48f29f1ff71d1e...
x_refsource_MISC

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.