CVE-2026-43884

🗓️ 11 May 2026 20:44:08Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 10 Views🌐 WEB

CVE-2026-43884: AVideo SSRF bypass via HTTP redirect to internal metadata after isSSRFSafeURL validation.

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2026-43884	27 Apr 202617:14	–	circl
CNNVD	WWBN AVideo 代码问题漏洞	11 May 202600:00	–	cnnvd
Cvelist	CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	11 May 202620:44	–	cvelist
Github Security Blog	AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	5 May 202622:16	–	github
Github Security Blog	AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`	15 May 202618:35	–	github
NVD	CVE-2026-43884	11 May 202622:22	–	nvd
OSV	CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	11 May 202620:44	–	osv
OSV	GHSA-2HCH-C97C-G99X AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	5 May 202622:16	–	osv
Positive Technologies	PT-2026-37300	5 May 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-43884	5 Jun 202619:23	–	redhatcve

Vulners

Node

wwbn avideoRange≤29.0

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "<= 29.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x
github	www.github.com/WWBN/AVideo/commit/603e7bf77a835584387327e35560262feb075db3
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99xg

Parameter	Position	Path	Description	CWE
url	request body	plugin/AI/receiveAsync.json.php	SSRF via user-supplied URL validated then fetched, bypassing protections due to redirect to internal addresses.	CWE-918
url	request body	objects/EpgParser.php	SSRF via user-supplied URL validated then fetched, bypassing protections due to redirect to internal addresses.	CWE-918

17 Jun 2026 10:50Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.7

EPSS0.00348

SSVC

CWE-918