Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-64626 Server-Side Request Forgery in AVideo via Unpinned Retry Fallback DNS Bypass https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-64626
Post summary
The post announces CVE-2026‑64626, a Server‑Side Request Forgery flaw in AVideo that exploits an unpinned retry fallback DNS bypass, but it does not provide a PoC, exploit code, patch, or evidence of active exploitation.