8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-33039

CVE-2026-33039: AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

WWBN AVideo is an open source video platform. In versions 25.0 and below, the plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect. This issue is fixed in version 26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-33039

CVE-2026-33039:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
wwbn/avideo	composer	<= 25.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) located in the plugin/LiveLinks/proxy.php script of AVideo. The script initially validates a user-supplied URL from the livelink parameter using isSSRFSafeURL. However, it then uses PHP's get_headers function, which, prior to the patch, would automatically follow HTTP redirects. If an attacker provided a safe initial URL that redirected to an internal or restricted URL, the script would extract this new, unvalidated URL from the Location header. This malicious URL was then passed directly to the fakeBrowser function. The fakeBrowser function executes a cURL request to any URL provided to it without performing any security checks. This allows an unauthenticated attacker to make the server issue requests to internal network resources, leading to information disclosure (e.g., cloud metadata) and internal network scanning. The patch mitigates this by disabling redirects in get_headers and, more importantly, adding a second validation step using isSSRFSafeURL on the URL from the Location header before it is ever passed to fakeBrowser.

Vulnerable functions

fakeBrowser

plugin/LiveLinks/proxy.php

The `fakeBrowser` function is the sink for the SSRF vulnerability. The vulnerability description states this function performs a raw cURL GET with no URL validation. The patch adds a call to `isSSRFSafeURL()` to validate the redirect URL *before* it is passed to `fakeBrowser`. This confirms that prior to the patch, `fakeBrowser` was called with an unvalidated, potentially malicious URL obtained from an HTTP redirect, leading to SSRF.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.