WWBN AVideo (<= 29.0) allows authenticated users to set a donation-notification webhook URL that can target internal network addresses or metadata services, leading to SSRF. The server performs a curl POST to this URL upon donations, but validation is insufficient, relying only on format checks and not the safer internal URL validation helper. The HTTP client follows redirects (CURLOPT_FOLLOWLOCATION enabled) without per-hop validation, enabling attackers to redirect requests to internal or loopback addresses via HTTP 307 responses. This behavior can be exploited to perform blind SSRF attacks. A code commit (aaacd48f29f1ff71d1eb5fc81d37605f593cefa9) contains an updated fix, but no official patch or vendor advisory is currently documented.

An authenticated attacker can cause the AVideo server to make arbitrary HTTP POST requests to internal or metadata service endpoints, potentially exposing sensitive internal resources or data. The vulnerability allows blind SSRF, which may lead to information disclosure or further internal network attacks. The CVSS score of 5.4 reflects a medium severity impact with low complexity and no user interaction required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A code commit exists with a fix, but no official patch or advisory is currently available. Until an official fix is released, restrict authenticated user ability to configure webhook URLs or implement network-level controls to prevent server-side requests to internal or sensitive IP ranges. Monitor vendor channels for updates and apply the official fix once available.