CVE-2026-33039 - Vulnerability Analysis

Overview

WWBN AVideo <= 25.0 contains a server-side request forgery caused by insufficient URL validation on HTTP redirects in plugin/LiveLinks/proxy.php, letting attackers access internal services via attacker-controlled redirects, exploit requires crafted URL input.

Severity & Score

Impact

Attackers can access internal network services, potentially exposing sensitive internal data or metadata.

Mitigation

Update to version 26.0 or later.

References

• https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917
• https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw

Social Media Activity(1 post)

TheHackerWire

@thehackerwire

Mar 20, 2026

🟠 CVE-2026-33039 - High (8.6) WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initi... 🔗 https://www.thehackerwire.com/vulnerability/CVE-2026-33039/ #CVE #vulnerability #infosec #cybersecurity #security #Tenda #patchstack

View original post

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner