WWBN AVideo versions 29.0 and earlier contain an SSRF vulnerability due to a logic flaw in the isSSRFSafeURL() function in objects/functions.php. The function's hostname check allows URLs matching the webSiteRootURL hostname to bypass SSRF protections without validating the port. This enables attackers to send requests to arbitrary ports on the server using the public hostname. The server saves the response body to a web-accessible path, facilitating data exfiltration. The vulnerability is tracked as CVE-2026-41060 with a CVSS 3.1 score of 7.7 (high severity). A code commit identified as a0156a6398362086390d949190f9d52a823000ba addresses the issue.

An attacker with at least low privileges can exploit this SSRF vulnerability to access arbitrary ports on the AVideo server by leveraging the hostname bypass and port ignorance in the SSRF protection logic. The attacker can retrieve responses from these internal services, which are saved to a web-accessible location, enabling full exfiltration of potentially sensitive data. The vulnerability does not impact confidentiality through direct compromise but allows information disclosure via SSRF. There is no indication of integrity or availability impact.

A fix for this vulnerability is available in the form of a code commit (a0156a6398362086390d949190f9d52a823000ba) that corrects the SSRF protection logic. Users of WWBN AVideo version 29.0 and below should upgrade to a version including this fix or apply the patch from the referenced commit. Since this is not a cloud service, remediation depends on applying the fix manually. Patch status is not explicitly stated in a vendor advisory; therefore, verify the vendor's official channels for updated releases or patches.