CVE-2026-126379: Vvveb 1.0.8.6 SSRF via oEmbed Proxy DNS Rebinding
Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated administrator who can control the editor oEmbedProxy url parameter can exploit it. The attacker needs a hostname capable of DNS rebinding.
What targets can be reached through the vulnerable proxy?
The issue can be used to request loopback services, internal panels, and cloud metadata endpoints. The described bypass applies when requesting URLs that do not use port 443.
Are default deployments affected?
The available information does not state whether the editor oEmbedProxy feature is enabled or reachable in a default deployment.