CVE-2026-43879— WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
Possible ATT&CK Techniques 2AI
T1187 · Forced Authentication T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-43879
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
WWBN AVideo: Blind SSRF in YPTWallet Donation Webhook via Missing isSSRFSafeURL() Check and CURLOPT_FOLLOWLOCATION Redirect Bypass
Source: NVD (National Vulnerability Database)
Vulnerability Description
WWBN AVideo is an open source video platform. In versions up to and including 29.0, an authenticated user can configure their own donation-notification webhook URL to point at internal/loopback/metadata hosts (e.g. http://127.0.0.1:8080/..., http://169.254.169.254/latest/..., RFC1918 addresses). When any other user (including a second account owned by the same attacker) donates even a trivial amount via plugin/CustomizeUser/donate.json.php, the AVideo server issues a curl POST to the attacker-supplied URL, resulting in a blind SSRF. The handler uses only isValidURL() (which is a format check) and does not call the codebase's own isSSRFSafeURL() helper. Additionally, CURLOPT_FOLLOWLOCATION is enabled with no per-hop revalidation, so even if the stored URL were validated, an HTTP 307 from an attacker-controlled host could redirect the POST to internal targets. Commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9 contains an updated fix.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
服务端请求伪造(SSRF)
Source: NVD (National Vulnerability Database)
Vulnerability Title
WWBN AVideo 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
WWBN AVideo是WWBN团队的一个由PHP编写的视频平台建站系统。 WWBN AVideo 29.0及之前版本存在代码问题漏洞，该漏洞源于未验证捐赠通知Webhook URL，可能导致攻击者利用SSRF访问内部或云元数据端点。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-43879
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-43879
请登录查看更多情报信息。
- https://github.com/WWBN/AVideo/security/advisories/GHSA-wp38-whx3-xffhx_refsource_CONFIRM
- https://nvd.nist.gov/vuln/detail/CVE-2026-43879
Same Patch Batch · WWBN · 2026-05-11 · 13 CVEs total
| CVE-2026-43884 | 7.7 HIGH | WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() |
| CVE-2026-43873 | 7.5 HIGH | WWBN AVideo: Unauthenticated Disclosure of CloneSite `myKey` via Error Echo in `cloneClien |
| CVE-2026-43874 | 7.2 HIGH | WWBN AVideo: Incomplete Fix for YPTSocket autoEvalCodeOnHTML Strip: Unauthenticated Cross- |
| CVE-2026-43875 | 6.8 MEDIUM | WWBN AVideo: Password Hash Leaked in MobileManager OAuth Redirect URL Enables Account Take |
| CVE-2026-43876 | 6.4 MEDIUM | WWBN AVideo: HTML Injection in notifySubscribers.json.php Enables Platform-Branded Phishin |
| CVE-2026-43878 | 6.1 MEDIUM | WWBN AVideo: Reflected XSS in plugin/Meet/iframe.php via Unescaped `user`/`pass` Parameter |
| CVE-2026-43877 | 5.4 MEDIUM | WWBN AVideo: CSRF in userSavePhoto.php Allows Cross-Origin Overwrite of Any Logged-in User |
| CVE-2026-43881 | 5.3 MEDIUM | WWBN AVideo: Unauthenticated User Enumeration in `objects/users.json.php` via `isCompany` |
| CVE-2026-43880 | 5.3 MEDIUM | WWBN AVideo: Unauthenticated Arbitrary Email Sending via sendEmail.json.php Allows Phishin |
| CVE-2026-43882 | 4.3 MEDIUM | WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler downloadICS.php Allows Calend |
| CVE-2026-43883 | 4.2 MEDIUM | WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allows Any Authenticated User to C |
| CVE-2026-43885 | WWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Author |
IV. Related Vulnerabilities
Same product: AVideo
- CVE-2026-43885
WWBN AVideo: Exposure of Sensitive Information to an Unautho - CVE-2026-43884
WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DN - CVE-2026-43883
WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allo - CVE-2026-43882
WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler - CVE-2026-43881
WWBN AVideo: Unauthenticated User Enumeration in `objects/us
Same vendor: WWBN
- CVE-2026-43885
WWBN AVideo: Exposure of Sensitive Information to an Unautho - CVE-2026-43884
WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DN - CVE-2026-43883
WWBN AVideo: IDOR in PayPalYPT agreementCancel.json.php Allo - CVE-2026-43882
WWBN AVideo: Unauthenticated CRLF/ICS Injection in Scheduler - CVE-2026-43881
WWBN AVideo: Unauthenticated User Enumeration in `objects/us
Same weakness: CWE-918
- CVE-2026-33234
AutoGPT: SendEmailBlock's IP blocklist bypass allows SSRF vi - CVE-2026-45245
Summarize < 0.15.1 Unauthorized Daemon Request via Untrusted - CVE-2026-6333
SSRF via Host Header Spoofing in Custom Slash Commands - CVE-2026-8768
vercel ai provider-utils download-blob.ts validateDownloadUr - CVE-2026-8725
CoreWorxLab CAAL test-hass Endpoint webhooks.py server-side
V. Comments for CVE-2026-43879
No comments yet