CVE-2026-64626

Received Received - Intake

AVideo Server-Side Request Forgery via Unpinned Retry

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-20

Last Modified

2026-07-20

Generated

2026-07-21

AI Q&A

2026-07-21

EPSS Evaluated

N/A

NVD

CVE-2026-64626

EUVD

EUVD-2026-46120

Affected Vendors & Products

Vendor	Product	Version / Range
avideo	avideo	From 0dbadbca (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

AVideo versions from commit 0dbadbca through latest master have a server-side request forgery (SSRF) vulnerability in the encoder download-by-URL feature. This occurs because an unpinned retry fallback bypasses DNS pinning validation. An authenticated attacker can provide a download URL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

Detection Guidance

Detecting this SSRF vulnerability requires checking AVideo's encoder download-by-URL flow for DNS pinning bypasses. Monitor network logs for internal address access attempts during external URL downloads. Inspect HTTP redirects in encoder flows for internal target access. Check for unpinned retry mechanisms in download logic.

Impact Analysis

An authenticated attacker could exploit this to make the server send requests to internal systems, potentially accessing sensitive data or services. This could lead to unauthorized information disclosure, internal network reconnaissance, or further attacks against internal infrastructure.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules for protected health information. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update AVideo to the latest version that fixes the unpinned retry fallback. Disable or restrict encoder download-by-URL functionality if not essential. Implement strict DNS pinning validation for all external URL downloads. Review and restrict internal network access for the AVideo service account.

Hi! I’m here to help you understand CVE-2026-64626. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70