Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-64626AVideo Encoder downloadURL SSRF via unpinned retry fallback

Medium 6.4

In plain English

A medium-severity server-side request forgery in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 14% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 86.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

Affected products (as reported)

Vendor	Product	Versions
WWBN	AVideo	0dbadbcaaa1b415c7db078a72dc4b26d9fac0485

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

GitHub Security Advisory (GHSA-fr98-mjq9-7jmj) vendor-advisory
Commit introducing the unpinned retry fallback (0dbadbca) related
VulnCheck Advisory: AVideo Encoder downloadURL SSRF via unpinned retry fallback third-party-advisory