WWBN AVideo before 29.4.0 contains a blind SSRF flaw in the getHeaderContentTypeFromURL() routine, as get_headers() follows redirects without re‑validating the target URL. An authenticated uploader may place a videoLink that points to a redirector; when a visitor renders the video, the application issues an internal GET request through the redirect chain, enabling the attacker to probe internal hosts and ports via an embed versus video render oracle. The payload does not provide direct code execution but allows internal network reconnaissance and potential exploitation of exposed services.

The vulnerability affects all installations of WWBN AVideo version 29.4.0 or earlier. The flaw is only exploitable by users who have upload privileges within the AVideo platform; no specific operating system or server configuration is required beyond the presence of the vulnerable software.

The CVSS score of 5.3 reflects a medium severity flaw. While the EPSS score is not available and the vulnerability is not listed in KEV, the attack requires an authenticated uploader to configure a redirecting videoLink and a site visitor to trigger the request. Consequently, exploitation probability is moderate, and the risk is primarily confined to internal network reconnaissance. System administrators should treat this as a medium‑risk issue pending a patch or effective mitigation.