CVE-2026-114634: Server-Side Request Forgery (SSRF) in WWBN AVideo

The vulnerability in WWBN AVideo prior to version 29.4.0 is a blind SSRF in the getHeaderContentTypeFromURL() function. The root cause is that get_headers() follows HTTP redirects without re-checking the safety of the redirected URLs via isSSRFSafeURL(). Authenticated users who can upload videos can supply a videoLink URL that redirects to internal network resources. When other users view the video, the server performs internal GET requests, enabling an attacker to scan internal ports by observing the server's behavior through the embed-versus-video render oracle.

An authenticated uploader can leverage this SSRF vulnerability to cause the server to make unauthorized internal network requests. This can lead to internal port scanning, potentially revealing information about internal network services. There is no indication of remote code execution or data exfiltration beyond internal network reconnaissance. The CVSS score is 5.3 (medium severity), reflecting limited impact but notable risk.

No explicit patch or fix information is provided. Since the vulnerability is identified in versions before 29.4.0, upgrading to version 29.4.0 or later is implied as a remediation step. If an official fix is not confirmed, users should restrict upload permissions to trusted users only and monitor for suspicious videoLink URLs. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.