CVE-2026-91966: AVideo through 29.0 Unauthenticated SSRF via Host Header
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the checksiteavailability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
AVideo versions through 29.0 are affected if submitIndex.php or ajax.php can be reached by an attacker over the network. No authentication is required.
What does an attacker need to exploit this issue?
An attacker only needs to send an HTTP request with an arbitrary Host header to submitIndex.php or ajax.php. The vulnerable check_site_availability function can then be used to probe internal hosts and ports, including by following redirects.
What is the practical impact of successful exploitation?
Successful exploitation allows server-side requests to attacker-selected internal network hosts and ports, which can expose services that are not directly reachable from the attacker. The provided severity vector indicates low confidentiality impact and no stated integrity or availability impact.