CVE-2026-91966

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 29.0

Description An unauthenticated server-side request forgery (SSRF) issue exists in the check site availability() function. This occurs because the function accepts attacker-controlled HTTP Host headers. By sending requests to the 'submitIndex.php' or 'ajax.php' endpoints with arbitrary Host headers, an attacker can probe internal network hosts and ports by following redirects without authentication. Server-side request forgery is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to a version newer than 29.0. As a temporary mitigation, restrict access to the 'submitIndex.php' and 'ajax.php' endpoints or disable the check site availability() function.