Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) in AVideo call isSSRFSafeURL() to validate user-supplied URLs, then fetch them using bare file_get_contents() without disabling PHP's automatic redirect following. An attacker can supply a URL pointing to a server they control that returns a 302 redirect to an internal/cloud-metadata address (e.g., http://169.254.169.254/latest/meta-data/). Since isSSRFSafeURL() only validates the initial URL, the redirect target bypasses all SSRF protections. Commit 603e7bf77a835584387327e35560262feb075db3 contains an updated fix.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
CVE-2026-43884 Server-Side Request Forgery via Redirect Bypass in WWBN AVideo Up to 29.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-43884
Post summary
The text announces CVE-2026-43884, a Server‑Side Request Forgery via redirect bypass affecting WWBN AVideo up to version 29.0.
⚠️ HIGH — CVE-2026-43884 WWBN AVideo is an open source video platform. In versions up to and including 29.0, two endpoints (plugin/AI/receiveAsy… CVSS 7.7 Full analysis → https://sec.kaitan.id/cves/CVE-2026-43884 #HP #CyberSecurity #InfoSec
Post summary
CVE-2026-43884 is disclosed for WWBN AVideo with a CVSS score of 7.7; no PoC, exploit, patch, or active exploitation details are provided.