CVE-2026-41055— AVideo has an incomplete fix for CVE-2026-33039 (SSRF)
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-41055
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AVideo has an incomplete fix for CVE-2026-33039 (SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, an incomplete SSRF fix in AVideo's LiveLinks proxy adds `isSSRFSafeURL()` validation but leaves DNS TOCTOU vulnerabilities where DNS rebinding between validation and the actual HTTP request redirects traffic to internal endpoints. Commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contains an updated fix.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WWBN AVideo 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WWBN AVideo是WWBN团队的一个由PHP编写的视频平台建站系统。 WWBN AVideo 29.0及之前版本存在代码问题漏洞，该漏洞源于LiveLinks代理中SSRF修复不完整，DNS TOCTOU漏洞可能导致DNS重定向到内部端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-41055
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-41055
请登录查看更多情报信息。
Same Patch Batch · WWBN · 2026-04-21 · 19 CVEs total
| CVE-2026-40911 | 10.0 CRITICAL | WWBN AVideo YPTSocket WebSocket Broadcast Relay Leads to Unauthenticated Cross-User JavaSc |
| CVE-2026-41064 | 9.3 CRITICAL | AVideo has an incomplete fix for CVE-2026-33502 (Command Injection) |
| CVE-2026-40909 | 8.7 HIGH | WWBN AVideo has a Path Traversal in Locale Save Endpoint that Enables Arbitrary PHP File W |
| CVE-2026-40925 | 8.3 HIGH | WWBN AVideo has CSRF in configurationUpdate.json.php Enables Full Site Configuration Takeo |
| CVE-2026-41056 | 8.1 HIGH | AVideos has CORS Origin Reflection with Credentials on Sensitive API Endpoints that Enable |
| CVE-2026-41058 | 8.1 HIGH | AVideo has an incomplete fix for CVE-2026-33293 (Path Traversal) in AVideo |
| CVE-2026-41060 | 7.7 HIGH | AVideo's SSRF via same-domain hostname with alternate port bypasses isSSRFSafeURL |
| CVE-2026-40926 | 7.1 HIGH | WWBN AVideo Vulnerable to CSRF in Admin JSON Endpoints (Category CRUD, Plugin Update Scrip |
| CVE-2026-41057 | 7.1 HIGH | AVideo has CORS Origin Reflection Bypass via plugin/API/router.php and allowOrigin(true) t |
| CVE-2026-40907 | 6.5 MEDIUM | WWBN AVideo has IDOR in Live Restreams list.json.php that Exposes Other Users' Stream Keys |
| CVE-2026-41062 | 6.5 MEDIUM | WWBN/AVideo has an incomplete fix for a directory traversal bypass via query string in Rec |
| CVE-2026-40928 | 5.4 MEDIUM | AVideo: Missing CSRF Protection on State-Changing JSON Endpoints Enables Forced Comment Cr |
| CVE-2026-40929 | 5.4 MEDIUM | WWBN AVideo's missing CSRF protection in objects/commentDelete.json.php enables mass comme |
| CVE-2026-41063 | 5.4 MEDIUM | WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) |
| CVE-2026-41061 | 5.4 MEDIUM | WWBN AVideo Vulnerable to stored XSS via Unanchored Duration Regex in Video Encoder Receiv |
| CVE-2026-40908 | 5.3 MEDIUM | WWBN AVideo has an Unauthenticated Information Disclosure via git.json.php that Exposes De |
| CVE-2026-40935 | 5.3 MEDIUM | WWBN/AVideo has CAPTCHA Bypass via Attacker-Controlled Length Parameter and Missing Token |
| CVE-2026-41304 | WWBN AVideo vulnerable to RCE caused by clonesite plugin |
IV. Related Vulnerabilities
Same product: AVideo
- CVE-2026-41304
WWBN AVideo vulnerable to RCE caused by clonesite plugin - CVE-2026-41064
AVideo has an incomplete fix for CVE-2026-33502 (Command Inj - CVE-2026-41063
WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) - CVE-2026-41062
WWBN/AVideo has an incomplete fix for a directory traversal - CVE-2026-41061
WWBN AVideo Vulnerable to stored XSS via Unanchored Duration
Same vendor: WWBN
- CVE-2026-41304
WWBN AVideo vulnerable to RCE caused by clonesite plugin - CVE-2026-41064
AVideo has an incomplete fix for CVE-2026-33502 (Command Inj - CVE-2026-41063
WWBN AVideo has incomplete fix for CVE-2026-33500 (XSS) - CVE-2026-41062
WWBN/AVideo has an incomplete fix for a directory traversal - CVE-2026-41061
WWBN AVideo Vulnerable to stored XSS via Unanchored Duration
Same weakness: CWE-918
- CVE-2026-8193
Akaunting Invoice PDF Rendering dompdf.php server-side reque - CVE-2026-44313
LinkWarden: Server-Side Request Forgery (SSRF) in Link Creat - CVE-2026-42352
pygeoapi 0.23.x: Unauthenticated SSRF via OGC API - Processe - CVE-2026-42346
Postiz: TOCTOU DNS rebinding bypasses all SSRF URL validatio - CVE-2026-42339
New API: SSRF Filter Bypass via 0.0.0.0
V. Comments for CVE-2026-41055
No comments yet