CVE-2026-41055 PUBLISHED

AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

Assigner: GitHub_M
Reserved: 16.04.2026 Published: 21.04.2026 Updated: 21.04.2026

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds isSSRFSafeURL() validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CVSS Score: 8.6

Attack Vector	Network	Scope	Changed
Attack Complexity	Low	Confidentiality Impact	High
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	None

CVSS 3.1

Product Status

Vendor	WWBN
Product	AVideo
Versions	Version < 26.0 is affected

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp
https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw
https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917
https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8

Problem Types

CWE-918: Server-Side Request Forgery (SSRF) CWE