CVE-2026-91967 is a blind SSRF vulnerability in WWBN AVideo through version 29.0. The issue exists in the getHeaderContentTypeFromURL function, which performs get_headers() calls on URLs provided by authenticated users with canUpload permission. These calls are only guarded by format validation, allowing attackers to supply malicious URLs that trigger server-side requests when video watch pages are rendered. This can be exploited to probe internal network hosts by observing content-type responses or timing differences. The vulnerability does not require user interaction beyond upload permissions and has no known exploits in the wild.

An attacker with authenticated canUpload permissions can leverage this SSRF vulnerability to make the server issue HTTP requests to arbitrary internal or external hosts. This can be used to gather information about internal network services or hosts that are not directly accessible to the attacker. The vulnerability does not escalate privileges or directly disclose sensitive data but can aid in further reconnaissance or chained attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict canUpload permissions to trusted users only and monitor for suspicious URL uploads. Avoid exposing internal services that could be probed via SSRF. Follow vendor updates for official patches or mitigations.