CVE-2026-41060
Last modified
CVE-2026-41060 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. EPSS estimates a 0.30% chance of exploitation in the next 30 days.
Description
WWBN AVideo is an open source video platform. In versions 29.0 and below, the `isSSRFSafeURL()` function in `objects/functions.php` contains a same-domain shortcircuit (lines 4290-4296) that allows any URL whose hostname matches `webSiteRootURL` to bypass all SSRF protections. Because the check compares only the hostname and ignores the port, an attacker can reach arbitrary ports on the AVideo server by using the site's public hostname with a non-standard port. The response body is saved to a web-accessible path, enabling full exfiltration. Commit a0156a6398362086390d949190f9d52a823000ba fixes the issue.
Metrics
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Wwbn | Avideo | <= 29.0 |
References
- https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8jExploit, Mitigation, Vendor Advisory
- https://github.com/WWBN/AVideo/security/advisories/GHSA-j432-4w3j-3w8jExploit, Mitigation, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2026-41060?
How severe is CVE-2026-41060?
How do I fix CVE-2026-41060?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-41055WWBN AVideo is an open source video platform. In versions 29…5.3
- CVE-2026-41056WWBN AVideo is an open source video platform. In versions 29…8.1
- CVE-2026-41057WWBN AVideo is an open source video platform. In versions 29…7.1
- CVE-2026-41058WWBN AVideo is an open source video platform. In versions 29…8.1
- CVE-2026-41059OAuth2 Proxy is a reverse proxy that provides authentication…8.2
- CVE-2026-4106The HT Mega Addons for Elementor WordPress plugin before 3.…5.3
- CVE-2026-41061WWBN AVideo is an open source video platform. In versions 29…5.4
- CVE-2026-41062WWBN AVideo is an open source video platform. In versions 29…6.5
- CVE-2026-41063WWBN AVideo is an open source video platform. In versions 29…5.4
- CVE-2026-41064WWBN AVideo is an open source video platform. In versions up…9.3
- CVE-2026-41065Tautulli is a Python based monitoring and tracking tool for …8.9
- CVE-2026-41066lxml is a library for processing XML and HTML in the Python …7.5
Are you affected by CVE-2026-41060?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST