PT-2026-34201 · Avideo · Avideo

Published 2026-04-14 · Updated 2026-04-26 · CVE-2026-41055

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 29.0 and earlier

Description An incomplete Server-Side Request Forgery (SSRF) fix in the LiveLinks proxy introduces a DNS Time-of-Check to Time-of-Use (TOCTOU) flaw. Although the isSSRFSafeURL() function provides validation, DNS rebinding can occur between the validation step and the actual HTTP request, allowing traffic to be redirected to internal endpoints.

Recommendations Apply the fix provided in commit 8d8fc0cadb425835b4861036d589abcea4d78ee8.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-41055

GHSA-793Q-XGJ6-7FRP

Affected Products

Avideo

References · 9

• 🔥 https://github.com/WWBN/AVideo/security/advisories/GHSA-793q-xgj6-7frp · Exploit
• https://github.com/WWBN/AVideo/commit/8d8fc0cadb425835b4861036d589abcea4d78ee8 · Patch
• https://github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41055 · Security Note
• https://osv.dev/vulnerability/GHSA-793q-xgj6-7frp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33039 · Security Note
• https://github.com/WWBN/AVideo · Note
• https://github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw · Note
• https://twitter.com/CVEnew/status/2048481071604322309 · Twitter Post