CVE-2026-33502
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b010ea28440b0d9a5ab3 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b01
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to probe localhost/internal services and, when reachable, access internal HTTP resources or cloud metadata endpoints. Commit 1e6cf03e93b5a5318204b01
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33502
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33502
WWBN AVideo is an open source video platform. In versions up to and including 26.0, an unauthenticated server-side request forgery vulnerability in allows any remote user to make the AVideo server send HTTP requests to arbitrary URLs. This can be used to pr
nvd.nist.gov