CVE-2026-15624 describes an SSRF vulnerability in nextlevelbuilder GoClaw 3.13.3-beta.3. The vulnerability arises from improper validation or sanitization of the output.video_url parameter in the bytePlusDownloadVideo function of the internal/tools/create_video_byteplus.go component. This flaw allows an attacker with at least low privileges to cause the server to make unintended HTTP requests, potentially leading to information disclosure or interaction with internal systems. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no user interaction, and limited confidentiality, integrity, and availability impacts. No official fix or patch has been documented as of the publication date.

Successful exploitation allows an attacker to induce the server to perform arbitrary HTTP requests to internal or external resources, which can lead to information disclosure or further network reconnaissance. The impact is limited to the extent of SSRF capabilities and does not directly indicate code execution or privilege escalation. The vulnerability requires low privileges and no user interaction, making remote exploitation feasible.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or monitor the use of the output.video_url parameter if possible. Network-level controls to limit server outbound requests may help reduce risk. Avoid exposing the vulnerable function to untrusted users.