Executive brief
WWBN AVideo is an open-source platform used for hosting and sharing video content. A security flaw in how the system validates web addresses allows an attacker to bypass internal security filters. This could lead to unauthorized access to sensitive internal data or the ability to interact with private services on the organization's internal network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in WWBN AVideo due to a Time-of-Check Time-of-Use (TOCTOU) race condition. While the application uses the isSSRFSafeURL() function to validate URLs, several components—including EpgParser.php and the AI plugin—fail to implement DNS pinning using the resolved IP address. An attacker can exploit this by using DNS rebinding to point a validated domain to a local or restricted IP address between the time of validation and the time of the actual request. This allows the attacker to bypass SSRF protections and access internal network resources. As of the advisory date, several call sites remain unpatched.
Affected products
- WWBN AVideo 29.0 and earlier
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: NVD publication date