CVE-2026-43884

🗓️ 11 May 2026 20:44:08Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 34 Views🌐 WEB

CVE-2026-43884: AVideo SSRF bypass via HTTP redirect to internal metadata after isSSRFSafeURL validation.

Reporter	Title	Published	Views	Family All 14
Circl	CVE-2026-43884	27 Apr 202617:14	–	circl
CNNVD	WWBN AVideo code-related vulnerabilities	11 May 202600:00	–	cnnvd
Cvelist	CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	11 May 202620:44	–	cvelist
Cvelist	CVE-2026-45619 AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post	29 May 202613:11	–	cvelist
Github Security Blog	AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	5 May 202622:16	–	github
Github Security Blog	AVideo CVE-2026-43884 incomplete fix - six (or more) `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post-`603e7bf`	15 May 202618:35	–	github
Mend	CVE-2026-43884	11 May 202620:44	–	mend
NVD	CVE-2026-43884	11 May 202622:22	–	nvd
osv_ghsa	GHSA-2HCH-C97C-G99X AVideo has SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL()	5 May 202622:16	–	osv_ghsa
Positive Technologies	PT-2026-37300	5 May 202600:00	–	ptsecurity

Vulners

Node

wwbn avideoRange≤29.0

[
  {
    "vendor": "WWBN",
    "product": "AVideo",
    "versions": [
      {
        "version": "<= 29.0",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/WWBN/AVideo/commit/603e7bf77a835584387327e35560262feb075db3
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99x
github	www.github.com/WWBN/AVideo/security/advisories/GHSA-2hch-c97c-g99xg

Parameter	Position	Path	Description	CWE
url	request body	/plugin/AI/receiveAsync.json.php	The endpoint calls isSSRFSafeURL() to validate a user-supplied URL but then uses file_get_contents() without disabling automatic redirects, allowing an attacker to bypass SSRF protections via a 302 redirect.	CWE-918
url	request body	/objects/EpgParser.php	The endpoint calls isSSRFSafeURL() to validate a user-supplied URL but then uses file_get_contents() without disabling automatic redirects, allowing an attacker to bypass SSRF protections via a 302 redirect.	CWE-918

17 Jun 2026 10:50Current

5.6Medium risk

Vulners AI Score5.6

CVSS 3.17.7

EPSS0.00426

SSVC

CWE-918