PT-2026-61743 · Avideo · Avideo

CVE-2026-64626 · Published 2026-07-20 · Updated 2026-07-21

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AVideo versions 0dbadbca through latest master

Description An authenticated attacker can perform blind Server-Side Request Forgery (SSRF) attacks by exploiting the encoder download-by-URL flow. The issue occurs because an unpinned retry fallback bypasses DNS pinning validation. By providing a downloadURL that redirects to an internal address, the attacker can force the system to follow the redirect and reach internal targets.

Recommendations Update AVideo to a version where the DNS pinning validation is correctly enforced during the retry fallback in the encoder download-by-URL flow.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-64626

Affected Products

Avideo

References · 5

• https://github.com/WWBN/AVideo/security/advisories/GHSA-fr98-mjq9-7jmj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-64626 · Security Note
• https://github.com/WWBN/AVideo/commit/0dbadbcaaa1b415c7db078a72dc4b26d9fac0485 · Note
• https://twitter.com/VulmonFeeds/status/2079427406834606468 · Twitter Post
• https://vulncheck.com/advisories/avideo-encoder-downloadurl-ssrf-via-unpinned-retry-fallback · Note