The vulnerability in WWBN AVideo (<= 29.0) involves two endpoints (plugin/AI/receiveAsync.json.php and objects/EpgParser.php) that use isSSRFSafeURL() to validate URLs before fetching them with PHP's file_get_contents(). However, file_get_contents() follows HTTP redirects automatically, and the validation only applies to the initial URL. An attacker can supply a URL that redirects (e.g., via HTTP 302) to internal or cloud metadata service addresses such as http://169.254.169.254/latest/meta-data/, effectively bypassing SSRF protections and potentially exposing sensitive internal information. A code commit (603e7bf77a835584387327e35560262feb075db3) contains an updated fix, but no official patch or vendor advisory is provided in the data.

Successful exploitation allows an attacker with low privileges to cause the server to make HTTP requests to internal or cloud metadata endpoints, potentially exposing sensitive information such as cloud instance metadata. The CVSS score of 7.7 reflects a high impact on confidentiality. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The referenced commit suggests a fix is available in the source code repository. Until an official patch is released, users should avoid exposing the vulnerable endpoints or restrict access to trusted users only. Monitor the vendor's official channels for updates and apply the fix once it is officially released.