Vulnerability · Published Sep 15, 2026 · Assigned by VulnCheck
CVE-2026-91966AVideo through 29.0 Unauthenticated SSRF via Host Header
Medium 5.8
In plain English
A medium-severity server-side request forgery in AVideo from WWBN. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).
Severity (CVSS 3.1)5.8Medium
Exploit odds (30 days)0.4%top 65.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.
Affected products (as reported)
Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
References
- GitHub Security Advisory (GHSA-rqg6-qcjv-55w5) vendor-advisory
- VulnCheck Advisory: AVideo through 29.0 Unauthenticated SSRF via Host Header third-party-advisory