SSRF Vulnerability in WWBN AVideo Open Source Video Platform

CVE-2026-43884

What is CVE-2026-43884?

WWBN AVideo, an open-source video platform, is susceptible to a Server-Side Request Forgery (SSRF) vulnerability due to improper validation of user-input URLs in versions up to and including 29.0. This flaw arises from using the isSSRFSafeURL() function to check the initial input, while subsequent redirects—such as those returning a 302 status code to an internal address—bypass all existing SSRF safeguards. As a result, an attacker could exploit this vulnerability to redirect requests and gain unauthorized access to sensitive internal data, including cloud metadata services. A patch has been released to address this issue, improving overall security for users of the platform. For details on the fix, refer to the commit linked in the advisories.

References