CVE-2026-33351
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in . When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the parameter is used directly to construct a URL that is fetched server-side via . No authentication, origin validation, or URL allowlisting is performed. Version 26.0 contains a patch for the issue.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in . When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the parameter is used directly to construct a URL that is fetched server-side via . No authentication, origin validation, or URL allowlisting is performed. Version 2
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in . When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file), the parameter is used directly to construct a URL that is fetched server-side via . No authentication, origin validation, or URL allowlisting is performed. Version 2
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33351
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33351
WWBN AVideo is an open source video platform. Prior to version 26.0, a Server-Side Request Forgery (SSRF) vulnerability exists in . When the AVideo Live plugin is deployed in standalone mode (the intended configuration for this file),
nvd.nist.gov