CVE-2026-114634: WWBN AVideo before 29.4.0 Blind SSRF via getHeaderContentTypeFromURL Redirect
WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL() because getheaders() follows redirects without re-validating targets with isSSRFSafeURL(). Authenticated uploaders can store a videoLink pointing to a redirector, causing internal GET requests when visitors view the video, enabling internal port scanning via the embed-versus-video render oracle.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WWBN AVideoto a version that resolves this vulnerability.Fixed in 29.4.0
Event History
Frequently Asked Questions
Which deployments require remediation?
WWBN AVideo versions before 29.4.0 are affected. The provided information does not identify any other affected version range.
What level of access does an attacker need?
An attacker needs authenticated uploader access to store a videoLink that points to a redirector. The redirect can lead the server to make requests to internal targets.
When are the server-side requests triggered?
The internal GET requests occur when visitors view the attacker-controlled video. This means a malicious uploader can rely on other users viewing the video to trigger requests.
What can an attacker learn or do through the issue?
The issue enables internal port scanning through an embed-versus-video rendering oracle. The vulnerability is described as blind SSRF, so the response is inferred from rendering behavior rather than directly returned to the attacker.