CVE-2026-43884
Stored SSRF via Redirect in WWBN AVideo
Publication date: 2026-05-11
Last updated on: 2026-05-11
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wwbn | avideo | to 29.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in WWBN AVideo, an open source video platform, in versions up to and including 29.0. Two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) validate user-supplied URLs using the function isSSRFSafeURL(), then fetch the URLs using PHP's file_get_contents() without disabling automatic redirect following.
An attacker can supply a URL that points to a server they control, which responds with a 302 redirect to an internal or cloud metadata address (such as http://169.254.169.254/latest/meta-data/). Because isSSRFSafeURL() only validates the initial URL and not the redirect target, the redirect bypasses all SSRF protections, allowing the attacker to access internal resources.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update WWBN AVideo to a version that includes the fix from commit 603e7bf77a835584387327e35560262feb075db3, which properly handles redirects in the isSSRFSafeURL() validation.
How can this vulnerability impact me? :
This vulnerability can allow an attacker to perform Server-Side Request Forgery (SSRF) attacks by bypassing URL validation protections. Specifically, the attacker can trick the server into making requests to internal or cloud metadata services that are normally inaccessible.
Such access can lead to exposure of sensitive internal information, including cloud instance metadata, which may contain credentials or configuration data. This can compromise the confidentiality of your system and potentially lead to further attacks or unauthorized access.