CVE-2026-91966 Overview
CVE-2026-91966 is an unauthenticated server-side request forgery (SSRF) vulnerability in AVideo through version 29.0. The flaw resides in the check_site_availability function, which accepts attacker-controlled HTTP Host headers without validation. Remote attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers, causing the application to issue outbound HTTP requests to attacker-specified destinations. Because the function follows redirects and requires no authentication, adversaries can probe internal network hosts, enumerate open ports, and reach services normally shielded from the internet. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.
Critical Impact
Unauthenticated attackers can leverage the AVideo server as a proxy to probe internal infrastructure, discover services on private networks, and interact with metadata endpoints or otherwise unreachable hosts.
Affected Products
- WWBN AVideo through version 29.0
- Deployments exposing submitIndex.php to untrusted networks
- Deployments exposing ajax.php to untrusted networks
Discovery Timeline
- 2026-09-15 - CVE-2026-91966 published to NVD
- 2026-09-16 - Last updated in NVD database
Technical Details for CVE-2026-91966
Vulnerability Analysis
AVideo is an open-source video streaming and management platform maintained by WWBN. The check_site_availability helper is designed to verify whether a target site is reachable, but it derives the destination from the incoming HTTP Host header rather than a validated internal source. When a request reaches submitIndex.php or ajax.php, the function constructs an outbound HTTP request using the attacker-supplied value.
The endpoint does not require authentication, so anyone able to reach the AVideo web server can trigger the outbound request. The function additionally follows HTTP redirects, which lets an attacker chain a public URL that redirects into private address space or to cloud metadata services. This expands the SSRF impact beyond simple host probing into cross-protocol reconnaissance of internal infrastructure.
Root Cause
The root cause is missing validation and allow-listing of the destination used by check_site_availability. The function trusts the client-controlled Host header as the target of a server-initiated HTTP request. There is no restriction preventing requests to loopback addresses, RFC1918 ranges, link-local ranges such as 169.254.169.254, or arbitrary external hosts. Redirect handling compounds the flaw by allowing indirect access to filtered destinations.
Attack Vector
Exploitation requires only network access to the AVideo web interface. An attacker issues an HTTP request to submitIndex.php or ajax.php while supplying a crafted Host header pointing to an internal IP, hostname, or port. The AVideo server then performs the outbound request on the attacker's behalf. Timing and response differences reveal whether the internal service exists, effectively turning the server into a reconnaissance proxy. See the VulnCheck AVideo SSRF Advisory and the upstream GitHub Security Advisory for technical details.
Detection Methods for CVE-2026-91966
Indicators of Compromise
- Web server access logs showing requests to submitIndex.php or ajax.php with unusual or non-local Host header values.
- Outbound HTTP connections from the AVideo host to internal RFC1918 addresses, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254.
- Repeated requests from a single source iterating through internal IP ranges or common service ports.
Detection Strategies
- Alert when the AVideo process initiates outbound HTTP requests to destinations outside an approved allow-list.
- Correlate inbound HTTP requests carrying non-standard Host headers with subsequent outbound connections from the same process.
- Flag HTTP responses to submitIndex.php or ajax.php whose timing patterns match port-scan behavior.
Monitoring Recommendations
- Capture and retain full HTTP request headers on the AVideo front-end to enable retroactive hunting for anomalous Host values.
- Monitor egress traffic from the AVideo server at the network layer and restrict outbound destinations by policy.
- Baseline normal outbound connectivity for the AVideo host and alert on deviations to internal address space.
How to Mitigate CVE-2026-91966
Immediate Actions Required
- Restrict network access to submitIndex.php and ajax.php at the reverse proxy or web application firewall until a patch is applied.
- Block outbound traffic from the AVideo server to internal ranges, loopback, and cloud metadata endpoints using host or network firewalls.
- Review web server logs for prior exploitation attempts involving unusual Host headers on the affected endpoints.
Patch Information
Refer to the GitHub Security Advisory GHSA-rqg6-qcjv-55w5 for the vendor's remediation guidance. AVideo versions through 29.0 are affected; operators should upgrade to a fixed release once available and validate that check_site_availability no longer trusts client-supplied Host header values.
Workarounds
- Enforce a strict allow-list of destinations at an outbound proxy to prevent the AVideo process from reaching internal hosts.
- Configure the web server or reverse proxy to reject requests whose Host header does not match the canonical AVideo hostname.
- Disable HTTP redirect following in any customized deployments of check_site_availability to reduce SSRF pivot opportunities.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
