CVE-2026-41060: AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL
WWBN AVideo is an open source video platform. In versions 29.0 and below, the isSSRFSafeURL() function in objects/functions.php contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches webSiteRootURL to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-41060?
CVE-2026-41060 has been classified as a high-severity vulnerability due to its potential for sensitive data exposure.
How do I fix CVE-2026-41060?
To fix CVE-2026-41060, upgrade AVideo to version 30.0 or later where the isSSRFSafeURL() function is properly secured.
Who is affected by CVE-2026-41060?
CVE-2026-41060 affects all users of the WWBN AVideo software versions 29.0 and below.
What type of vulnerability is CVE-2026-41060?
CVE-2026-41060 is categorized as a Server-Side Request Forgery (SSRF) vulnerability that can lead to unauthorized access to internal resources.
What are the potential impacts of CVE-2026-41060?
The potential impacts of CVE-2026-41060 include the ability for attackers to access sensitive information and services by exploiting the vulnerability.