CVE-2026-85164: Server-Side Request Forgery (SSRF)

WWBN AVideo through commit c91b5975d contains a server-side request forgery vulnerability in the setapiuserImages API endpoint that fails to validate profileImg and backgroundImg URLs before fetching them. Authenticated API clients can supply internal URLs to fetch cloud metadata or internal...