CVE-2026-33237 - Vulnerability Analysis

Overview

WWBN AVideo < 26.0 contains a server side request forgery caused by insufficient validation of admin-configurable callbackURL in Scheduler plugin, letting attackers perform SSRF to internal network endpoints, exploit requires admin configuration.

Severity & Score

Impact

An attacker with admin access can perform SSRF to internal or cloud metadata endpoints, potentially exposing sensitive internal data or services.

Mitigation

Upgrade to version 26.0 or later.

References

• https://github.com/WWBN/AVideo/commit/df926e500580c2a1e3c70351f0c30f4e15c0fd83
• https://github.com/WWBN/AVideo/security/advisories/GHSA-v467-g7g7-hhfh

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner