CVE-2026-64626 describes an SSRF vulnerability in WWBN AVideo's encoder download-by-URL flow. The root cause is an unpinned retry fallback that circumvents DNS pinning validation, allowing an authenticated attacker to provide a download URL that redirects to internal IP addresses. This leads to blind SSRF attacks against internal targets. The vulnerability affects all versions from commit 0dbadbca through the latest master branch at the time of disclosure. No vendor advisory or patch information is currently available.

An authenticated attacker can exploit this vulnerability to cause the server to make HTTP requests to internal network resources that are otherwise inaccessible externally. This may lead to unauthorized internal network reconnaissance or interaction with internal services. The impact is limited by the requirement for authentication and the medium severity rating.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict authenticated user capabilities to supply arbitrary download URLs if possible, and monitor for unusual internal request activity related to the encoder download feature.