WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 Patch
- https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8 Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp Exploit, Mitigation, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp Exploit, Mitigation, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · wwbnNVD modified 2026-10-26 21:10
Affected (CPE criteria) 1
cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*
References 5
- https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 Patch
- https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8 Patch
- https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp Exploit, Mitigation, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw Not Applicable
- https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp Exploit, Mitigation, Vendor Advisory