CVE-2026-43879

{
  "id": "CVE-2026-43879",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-11T22:22:12.390",
  "lastModified": "2026-10-26T18:10:00.173",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses). When any other user (including a second account owned by the same attacker) donates even a trivial amount via plugin/CustomizeUser/donate.json.php, the AVideo server issues a curl POST to the attacker-supplied URL, resulting in a blind SSRF. The handler uses only isValidURL() (which is a format check) and does not call the codebase's own isSSRFSafeURL() helper. Additionally, CURLOPT_FOLLOWLOCATION is enabled with no per-hop revalidation, so even if the stored URL were validated, an HTTP 307 from an attacker-controlled host could redirect the POST to internal targets. Commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9 contains an updated fix."
    },
    {
      "lang": "es",
      "value": "WWBN AVideo es una plataforma de video de código abierto. En versiones hasta la 29.0 inclusive, un usuario autenticado puede configurar su propia URL de webhook de notificación de donación para que apunte a hosts internos/de bucle invertido/de metadatos (p. ej., http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., direcciones RFC1918). Cuando cualquier otro usuario (incluida una segunda cuenta propiedad del mismo atacante) dona incluso una cantidad trivial a través de plugin/CustomizeUser/donate.json.php, el servidor AVideo emite un POST de curl a la URL proporcionada por el atacante, lo que resulta en un SSRF ciego. El gestor utiliza solo isValidURL() (que es una comprobación de formato) y no llama al ayudante isSSRFSafeURL() propio de la base de código. Además, CURLOPT_FOLLOWLOCATION está habilitado sin revalidación por salto, por lo que incluso si la URL almacenada fuera validada, un HTTP 307 de un host controlado por el atacante podría redirigir el POST a objetivos internos. El commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9 contiene una corrección actualizada."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "WWBN",
          "product": "AVideo",
          "versions": [
            {
              "version": "<= 29.0",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-15T18:22:33.697750Z",
          "id": "CVE-2026-43879",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-918"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/WWBN/AVideo/commit/aaacd48f29f1ff71d1eb5fc81d37605f593cefa9",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wp38-whx3-xffh",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/WWBN/AVideo/security/advisories/GHSA-wp38-whx3-xffh",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ]
}