CVE-2026-91966 is an SSRF vulnerability in WWBN AVideo through version 29.0. The flaw exists in the check_site_availability function, which accepts attacker-controlled HTTP Host headers. Attackers can exploit this by sending requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network resources and ports. The vulnerability does not require authentication and allows following redirects, increasing the potential for internal network reconnaissance.

An unauthenticated attacker can leverage this SSRF vulnerability to send crafted requests with arbitrary Host headers, enabling internal network scanning and reconnaissance. This may expose internal services and ports that are otherwise inaccessible externally. The vulnerability does not directly allow code execution or data exfiltration but can be used as a stepping stone for further attacks within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected endpoints and consider implementing network-level controls to limit internal host probing. Monitor for unusual requests with manipulated Host headers targeting submitIndex.php or ajax.php.