CVE-2026-64626: AVideo Encoder downloadURL SSRF via unpinned retry fallback
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64626?
CVE-2026-64626 has a medium severity rating of 5.3.
How do I fix CVE-2026-64626?
To fix CVE-2026-64626, update AVideo Encoder to the latest version that addresses the SSRF vulnerability.
What types of attacks are possible with CVE-2026-64626?
CVE-2026-64626 allows authenticated attackers to exploit server-side request forgery vulnerabilities.
Which versions of AVideo are affected by CVE-2026-64626?
AVideo versions from commit 0dbadbca through the latest master are affected by CVE-2026-64626.
What is the impact of CVE-2026-64626?
The impact of CVE-2026-64626 includes the potential for an attacker to redirect internal requests to unauthorized locations.