ZeroDay Findings
Sign inSign up

Findings

CVE-2026-33237

WWBN AVideo is an open source video platform.

Published Mar 21, 2026 · updated Jun 17, 2026 · wwbn avideo

WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's function in calls with an admin-configurable that is validated only by (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler's callback URL is never passed through , which blocks requests to RFC-1918 private addresses, loopback, and cloud metadata endpoints. An admin can configure a scheduled task with an internal network to perform SSRF against cloud infrastructure metadata services or internal APIs not otherwise reachable from the internet. Version 26.0 contains a patch for the issue.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 21, 2026 · NIST NVD

    Detected

    WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's function in calls with an admin-configurable that is validated only by (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler's callback URL is never passed through , which blocks requests to RFC-1918 private addresses,

  2. Jun 17, 2026 · NIST NVD

    Updated

    WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's function in calls with an admin-configurable that is validated only by (URL format check). Unlike other AVideo endpoints that were recently patched for SSRF (GHSA-9x67-f2v7-63rw, GHSA-h39h-7cvg-q7j6), the Scheduler's callback URL is never passed through , which blocks requests to RFC-1918 private addresses,

Affected

  • cpe wwbn/avideoversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2026-33237

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-33237

    WWBN AVideo is an open source video platform. Prior to version 26.0, the Scheduler plugin's function in calls with an admin-configurable that is validated only by (URL format check). Unlike

    nvd.nist.gov

References