CVE-2026-34740 - Vulnerability Analysis

Overview

WWBN AVideo <= 26.0 contains a stored server-side request forgery caused by insufficient URL validation in the EPG link feature, letting authenticated users with upload permissions scan internal networks and access internal services, exploit requires upload permissions.

Severity & Score

Impact

Authenticated users with upload permissions can perform SSRF to scan internal networks and access sensitive internal services.

Mitigation

Update to the latest version once a patch is available or implement proper SSRF protections.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-x5vx-vrpf-r45f

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner