A video hosting platform contains a proxy endpoint that accepts a user‑supplied URL and forwards the request to that URL. The code validates the initial URL for internal network addresses but does not re‑validate the URL after following an HTTP redirection. This allows an attacker to supply a URL that first redirects to an internal or cloud metadata endpoint, which is then fetched by the proxy unfiltered, giving the attacker access to internal resources without authentication. The primary impact is the ability to exfiltrate internal data or craft requests to internal services, compromising confidentiality and potentially enabling further attacks.

The flaw exists in the WWBN AVideo platform, specifically in versions 25.0 and older within the LiveLinks/proxy.php endpoint. The vulnerability was addressed in version 26.0, where each redirection is validated against internal addresses.

The vulnerability is scored 8.6 on the CVSS metric and has an EPSS likelihood of less than 1 %. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attacker must send a request to the proxy endpoint, which is typically reachable from any network that can reach the web application. An unauthenticated attacker can thus exploit this flaw to reach internal services and potentially compromise infrastructure. The risk is significant due to the high CVSS score, but the low EPSS suggests that widespread exploitation is currently unlikely.