CVE-2026-114634 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, particularly those exposed to internal networks, should assess potential impact and verify exposure. This includes operators, platform administrators, vulnerability management teams, and security teams who need to understand the vulnerability's impact on their environments and take appropriate actions to mitigate it.

Why it matters

Defenders should care about CVE-2026-114634 because it allows authenticated uploaders to perform blind server-side request forgery, potentially leading to internal port scanning and unauthorized internal service discovery.

• Internal port scanning via the embed-versus-video render oracle
• Potential unauthorized internal service discovery
• Possible data exfiltration via internal requests

Technical summary

The getHeaderContentTypeFromURL() function in WWBN AVideo before 29.4.0 follows redirects without re-validating targets with isSSRFSafeURL(), allowing authenticated uploaders to store a videoLink pointing to a redirector and cause internal GET requests when visitors view the video. This can lead to internal port scanning and potential unauthorized internal service discovery. Defenders should prioritize verifying exposure of AVideo instances to internal networks and assessing potential impact on port scanning and internal service discovery.

Defensive priority

Defenders should prioritize verifying exposure of AVideo instances to internal networks and assessing potential impact on port scanning and internal service discovery.

Recommended defensive actions

• Verify AVideo instances are updated to version 29.4.0 or later
• Assess exposure of AVideo instances to internal networks
• Monitor internal GET requests for potential port scanning activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the blind server-side request forgery vulnerability in WWBN AVideo before 29.4.0. The vulnerability is caused by the getHeaderContentTypeFromURL() function following redirects without re-validating targets with isSSRFSafeURL().

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.