CVE-2026-33039: AVideo vulnerable to unauthenticated SSRF via HTTP redirect bypass in LiveLinks proxy

March 17, 2026 (updated March 20, 2026)

The plugin/LiveLinks/proxy.php endpoint validates user-supplied URLs against internal/private networks using isSSRFSafeURL(), but only checks the initial URL. When the initial URL responds with an HTTP redirect (Location header), the redirect target is fetched via fakeBrowser() without re-validation, allowing an attacker to reach internal services (cloud metadata, RFC1918 addresses) through an attacker-controlled redirect.

References

github.com/WWBN/AVideo
github.com/WWBN/AVideo/commit/0e56382921fc71e64829cd1ec35f04e338c70917
github.com/WWBN/AVideo/security/advisories/GHSA-9x67-f2v7-63rw
github.com/advisories/GHSA-9x67-f2v7-63rw
nvd.nist.gov/vuln/detail/CVE-2026-33039

Code Behaviors & Features

Detect and mitigate CVE-2026-33039 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →