CVE-2026-91966 in AVideo
Summary
by MITRE • 09/15/2026
AVideo through 29.0 contains an unauthenticated server-side request forgery vulnerability in the check_site_availability function that accepts attacker-controlled HTTP Host headers. Attackers can send requests to submitIndex.php or ajax.php with arbitrary Host headers to probe internal network hosts and ports, following redirects without authentication.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/15/2026
The identified security flaw resides within AVideo versions up to 29.0, specifically targeting the check_site_availability function which is exposed through endpoints such as submitIndex.php and ajax.php. This vulnerability constitutes a classic Server-Side Request Forgery (SSRF) issue where the application fails to properly validate or sanitize HTTP Host headers supplied by external clients. By accepting arbitrary values for this header without sufficient restriction, the server effectively allows an unauthenticated attacker to dictate which internal resources are accessed during request processing. The core technical failure lies in the lack of input validation on the Host header, a critical component that determines the target host and port for subsequent network operations within the application logic.
From a technical perspective, this SSRF vulnerability enables attackers to probe internal network infrastructure without requiring any form of authentication or prior access credentials. Because the function processes these requests directly from external sources, an adversary can craft HTTP packets with manipulated Host headers pointing toward private IP ranges, localhost addresses, or specific service ports that are not intended for public exposure. The ability to follow redirects further exacerbates the risk, as it allows attackers to bypass simple host-based filtering mechanisms by chaining multiple redirections to reach their ultimate target within the internal network topology. This capability transforms a standard web application endpoint into a pivot point for lateral movement and reconnaissance against backend systems that are otherwise shielded from direct internet access.
The operational impact of this vulnerability is significant, primarily due to its unauthenticated nature which lowers the barrier to entry for exploitation. Attackers can utilize this flaw to conduct network mapping, identify running services on internal hosts, detect open ports, and potentially interact with sensitive administrative interfaces or databases that reside behind firewalls but are accessible via HTTP/HTTPS protocols from within the server environment. If these internal services have their own weak authentication mechanisms or no security controls at all, the SSRF can serve as a gateway to full system compromise. Furthermore, this vulnerability aligns with CWE-918, which defines Server-Side Request Forgery flaws where web applications retrieve data from URLs provided by users without proper validation of the destination's trustworthiness.
In terms of threat modeling and attack classification, this behavior is consistent with MITRE ATT&CK technique T1570, specifically subtechnique Lateral Tool Transfer or Network Service Discovery depending on the specific payload used to probe internal hosts. The exploitation path involves sending crafted requests to public-facing endpoints to trigger server-side actions that interact with private network resources. To mitigate this risk, developers must implement strict allow-listing for any hostnames or IP addresses permitted in the Host header and other similar input fields. Additionally, implementing egress filtering at the network level can restrict outbound connections from the application server to only those destinations strictly necessary for its operation. Input validation should also be enforced to reject requests containing private IP ranges such as 10.x.x.x, 172.16-31.x.x, and 192.168.x.x in any header or parameter that influences network routing decisions within the application logic.