Vulnerability · Published Apr 21, 2026 · Assigned by GitHub_M

CVE-2026-41060AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL

High 7.7

In plain English

A high-severity server-side request forgery in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)7.7High

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	wwbn/avideo	no fix listed	GHSA-j432-4w3j-3w8j

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	<= 29.0

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8j x_refsource_CONFIRM
https://github.com/WWBN/AVideo/commit/a0156a6398362086390d949190f9d52a823000ba x_refsource_MISC