CVE-2026-41055

Katalog CVE

CVSS 5.3 · Medium EPSS 0,44%

Kerentanan Server-Side Request Forgery (SSRF) pada wwbn avideo. Skor CVSS 3.1 5.3 (Medium) menurut NVD.

Deskripsi (NVD)

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

Rincian

Terbit di NVD

21 April 2026

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

5.3 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp exploit · mitigasi · advisory vendor
• https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 patch
• https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8 patch
• https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw not applicable