# CVE-2026-114634: WWBN AVideo server-side request forgery in getHeaderContentTypeFromURL()

Source: https://junglewise.ai/threats/cve-2026-114634-wwbn-avideo-before-29-4-0-contains-a-blind-server-side-request  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-22. Updated: 2026-10-22  
License: CC BY 4.0 with a link back

CVE-2026-114634 · Severity: medium · CVSS 4.3 · Published 2026-10-22

WWBN AVideo is a video hosting platform that allows users to add videos via URL. The vulnerability allows authenticated users to upload a video with a malicious URL pointing to an attacker-controlled redirector. When any visitor views the video, the server makes an internal HTTP request to the attacker's chosen destination, enabling attackers to scan internal network services and detect internal infrastructure without direct access.

Technologies: [WWBN AVideo](https://junglewise.ai/threats/technologies/avideo). Vendors: [WWBN](https://junglewise.ai/threats/vendors/wwbn).

## Quick answers

**Is CVE-2026-114634 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114634 being exploited in the wild.

**How severe is CVE-2026-114634?** Medium severity, with a CVSS score of 4.3, published 22 October 2026.

**Which products and versions are affected?** WWBN AVideo before 29.4.0.

**Is there a fix for CVE-2026-114634?** Yes: fixed in AVideo 29.4.0. Until then: Restrict video upload by URL to trusted users only, or disable the videoLink feature entirely if not actively used. Monitor outbound HTTP requests from the server to detect anomalous patterns. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114634 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-114634?** Check whether you run WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in AVideo 29.4.0

Restrict video upload by URL to trusted users only, or disable the videoLink feature entirely if not actively used. Monitor outbound HTTP requests from the server to detect anomalous patterns.

## Technical details

The getHeaderContentTypeFromURL() function validates the initial URL with isSSRFSafeURL() but then calls PHP's get_headers() which automatically follows HTTP redirects without re-validating the target. An attacker can craft a video link pointing to a public server that redirects to internal infrastructure (e.g., 127.0.0.1:8900 or AWS metadata endpoints), which get_headers() follows transparently. The content-type response functions as a boolean oracle for port scanning, allowing attackers to infer whether internal services are reachable.

## Affected products

- WWBN AVideo before 29.4.0

## Timeline

- 2026-10-07: disclosed: Fix commit 2db920d3326729743511a27de44034b0a6c78b05 published
- 2026-10-22: advisory: CVE-2026-114634 published

## References

- [https://github.com/WWBN/AVideo/commit/2db920d3326729743511a27de44034b0a6c78b05](https://github.com/WWBN/AVideo/commit/2db920d3326729743511a27de44034b0a6c78b05)
- [https://github.com/WWBN/AVideo/security/advisories/GHSA-m8q2-35pq-qrmc](https://github.com/WWBN/AVideo/security/advisories/GHSA-m8q2-35pq-qrmc)

## Related threats

- [WWBN AVideo stored cross-site scripting in channel feed](https://junglewise.ai/threats/cve-2026-126810-wwbn-avideo-29-1-0-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo missing authorization in import and file operations](https://junglewise.ai/threats/cve-2026-126809-wwbn-avideo-through-29-7-1-contains-a-missing-authorization)
- [WWBN AVideo stored cross-site scripting in video download link](https://junglewise.ai/threats/cve-2026-126806-wwbn-avideo-14-3-through-29-7-1-contains-a-stored-cross-site)
- [WWBN AVideo incorrect authorization in encoder endpoints](https://junglewise.ai/threats/cve-2026-126805-wwbn-avideo-through-29-7-1-contains-an-incorrect-authorization)
- [WWBN AVideo path traversal in ADs plugin deleteImage.json.php](https://junglewise.ai/threats/cve-2026-126804-wwbn-avideo-12-4-through-29-7-1-contains-a-path-traversal)