CVE-2026-91967 Overview
CVE-2026-91967 is a blind Server-Side Request Forgery (SSRF) vulnerability in AVideo versions through 29.0. The flaw resides in the getHeaderContentTypeFromURL function, which issues get_headers() calls guarded only by URL format validation. Authenticated users with canUpload permission can store attacker-chosen URLs as video links. Each subsequent video watch page render triggers the vulnerable function, allowing attackers to probe internal hosts using content-type oracles and timing-based detection. The vulnerability is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
Authenticated attackers can enumerate internal network services and infrastructure by weaponizing stored video URLs as blind SSRF probes triggered on every watch page render.
Affected Products
- AVideo (WWBN) versions through 29.0
- Deployments exposing the video upload functionality to authenticated users
- Instances where the canUpload permission is granted to standard user roles
Discovery Timeline
- 2026-09-15 - CVE-2026-91967 published to NVD
- 2026-09-17 - Last updated in NVD database
Technical Details for CVE-2026-91967
Vulnerability Analysis
The vulnerability lives in the getHeaderContentTypeFromURL function within AVideo. When a video record is created or viewed, AVideo invokes this function against the stored URL to determine the resource's content type. The function relies on PHP's native get_headers() call, which performs an outbound HTTP request from the server. Because the only validation applied is superficial URL format checking, attackers can supply arbitrary internal targets such as http://127.0.0.1, http://169.254.169.254/latest/meta-data/, or RFC1918 addresses.
The exploit becomes persistent because the URL is stored as a video link. Every render of the watch page re-triggers the outbound request, giving attackers a repeatable oracle for enumerating internal services and mapping infrastructure.
Root Cause
The root cause is missing destination validation before issuing server-side HTTP requests. Format validation confirms the URL parses correctly but does not restrict schemes, hostnames, or resolved IP addresses. There is no allowlist enforcement, DNS pinning, or block on private and link-local ranges.
Attack Vector
Exploitation requires an authenticated account with canUpload privileges. The attacker submits a video with an external URL pointing to an internal target. Although the response body is not returned to the client, attackers infer state through two side channels: content-type headers echoed by the internal service and response timing differences between open and closed ports. Repeated watch page renders amplify the oracle. Full technical details are available in the GitHub Security Advisory and the VulnCheck Advisory on AVideo.
Detection Methods for CVE-2026-91967
Indicators of Compromise
- Outbound HTTP requests from the AVideo web server to RFC1918 addresses, 127.0.0.0/8, or link-local ranges such as 169.254.169.254
- Video records containing non-media URLs referencing internal hostnames, IP literals, or unusual ports
- Elevated volume of get_headers() invocations correlated with watch page renders for specific video IDs
Detection Strategies
- Instrument the web server to log all outbound requests originating from the AVideo PHP process and alert on destinations outside expected content delivery networks
- Review the video database for URLs whose host resolves to private IP space or cloud metadata endpoints
- Correlate watch page access logs with outbound network flows to identify attacker-controlled probing patterns
Monitoring Recommendations
- Enable egress firewall logging on the application server and forward events to a centralized analytics platform for baseline deviation analysis
- Monitor authentication logs for newly created accounts that immediately begin uploading video records
- Track anomalous DNS resolutions from the web server, particularly requests for cloud metadata service hostnames
How to Mitigate CVE-2026-91967
Immediate Actions Required
- Restrict the canUpload permission to trusted users only and audit existing role assignments
- Apply upstream fixes from the AVideo project once released; monitor the GitHub Security Advisory for patch availability
- Enforce egress network controls that block the AVideo server from reaching internal management interfaces and cloud metadata endpoints
Patch Information
AVideo versions through 29.0 are affected. Consult the GitHub Security Advisory GHSA-vjgr-5x63-cq96 for remediation status and version guidance. Upgrade to the fixed release once published by the maintainers.
Workarounds
- Deploy a web application firewall rule that rejects video URL submissions resolving to private, loopback, or link-local IP ranges
- Configure an egress proxy for the AVideo server that enforces an allowlist of permitted external hosts for content-type probing
- Disable or remove the getHeaderContentTypeFromURL invocation on the watch page as a temporary source-level mitigation until an official patch is applied
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
