CVE-2026-41055 HIGH

CVE-2026-41055: AVideo has an incomplete fix for CVE-2026-33039 (SSRF)

Vendor Wwbn
Product AVideo
Weakness CWE-918 · SSRF
Published April 21, 2026
Last update April 22, 2026
View on NVD All CVEs

CVSS base score

8.6/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

What the vulnerability does

01Description

WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.

Key dates

02Disclosure timeline

April 21, 2026 CVE published
April 22, 2026 Record updated