CVE-2026-91966 WWBN CVE debrief

Who should care

Defenders responsible for AVideo instances, network administrators, and security teams should assess exposure and potential impact. They should verify whether AVideo instances are exposed to untrusted networks and evaluate the security of internal network hosts and ports that may be probed. Security teams must prioritize verifying exposure and assessing internal network security to mitigate potential risks associated with this vulnerability.

Why it matters

Defenders should care about CVE-2026-91966 because it allows attackers to probe internal network hosts and ports without authentication, potentially leading to unauthorized network reconnaissance and sensitive information disclosure. AVideo instances exposed to untrusted networks are at risk, and defenders should verify exposure and assess internal network security.

• Probing internal network hosts and ports without authentication
• Potential for unauthorized network reconnaissance
• Risk of sensitive information disclosure
• Need for verification of AVideo instance exposure and internal network security

Technical summary

The check_site_availability function in AVideo through 29.0 accepts attacker-controlled HTTP Host headers, allowing attackers to send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication. This vulnerability enables attackers to conduct server-side request forgery attacks without authentication, potentially leading to unauthorized network reconnaissance and sensitive information disclosure. AVideo instances exposed to untrusted networks are at risk, and defenders should verify exposure and assess internal network security.

Defensive priority

Defenders should prioritize verifying exposure of AVideo instances to untrusted networks and assessing internal network hosts and ports that may be probed.

Recommended defensive actions

• Verify AVideo instances are not exposed to untrusted networks
• Assess internal network hosts and ports that may be probed
• Monitor for suspicious requests to submitIndex.php or ajax.php
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in AVideo through 29.0, including an unauthenticated server-side request forgery vulnerability in the check_site_availability function. Additional information on affected versions, exploitation, and remediation is limited. Defenders should verify exposure of AVideo instances to untrusted networks and assess internal network security. Evidence is limited to CVE and NVD details, with no additional public information available. Supplied source references provide minimal or

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.