CVE-2026-64626

Katalog CVE

CVSS 6.4 · Medium EPSS 0,32%

Kerentanan Server-Side Request Forgery (SSRF). Skor CVSS 3.1 6.4 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

Rincian

Terbit di NVD

20 Juli 2026

Terakhir diubah

23 Juli 2026

Status NVD

Deferred

CVSS 3.1

6.4 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-918: Server-Side Request Forgery (SSRF)

EPSS (30 hari)

0,32% peluang dieksploitasi; lebih tinggi dari 23,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/WWBN/AVideo/commit/0dbadbcaaa1b415c7db078a72dc4b26d9fac0485
• https://github.com/WWBN/AVideo/security/advisories/GHSA-fr98-mjq9-7jmj
• https://www.vulncheck.com/advisories/avideo-encoder-downloadurl-ssrf-via-unpinned-retry-fallback