CVE-2026-64626

Medium

Description

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.

SeverityMedium

CVSS6.4

Exploit probability—

ProductAVideo

PublishedJul 20, 2026

First seenJul 20, 2026

Weakness typeCWE-918Server-side request forgery (SSRF)

How to fix

Vendor advisories

github.com/WWBN/AVideo/security/advisories/GHSA-fr98-mjq9-7jmj

Affected products

Product	Affected versions	Fixed in
WWBN AVideo	0dbadbcaaa1b415c7db078a72dc4b26d9fac0485	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.