CVE-2026-43879
Authenticated Blind SSRF in WWBN AVideo via Donation Webhook
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 29.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. An authenticated user can set their own donation-notification webhook URL to point to internal, loopback, or metadata hosts such as 127.0.0.1 or 169.254.169.254. When another user makes a donation, the server sends a POST request to the attacker-supplied URL, resulting in a blind Server-Side Request Forgery (SSRF). The URL validation only checks the format and does not properly restrict unsafe URLs. Additionally, the server follows HTTP redirects without revalidation, which can be exploited to redirect requests to internal targets.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to make the AVideo server send unauthorized requests to internal or protected network resources. This could lead to information disclosure from internal services, unauthorized access to metadata endpoints, or other internal systems that are normally inaccessible from outside. The attacker can exploit this SSRF to gather sensitive information or potentially escalate attacks within the internal network.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade WWBN AVideo to a version later than 29.0 where the issue is fixed (commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9).
Additionally, restrict or validate user-configured webhook URLs more strictly to prevent pointing to internal or loopback addresses.
Disable or carefully control CURLOPT_FOLLOWLOCATION to prevent HTTP redirects from bypassing URL validation.