AVideo versions up to 29.0 contain an incomplete protection for Server‑Side Request Forgery (CWE‑918) in its LiveLinks proxy. The mitigation added an isSSRFSafeURL() filter but did not address the DNS Time‑of‑Check to Time‑of‑Use flaw, allowing an attacker to perform DNS rebinding between the safe‑URL check and the actual request. This enables the attacker to cause the proxy to resolve a name that initially appears safe but later resolves to an internal IP or hostname, thereby giving the attacker access to internal resources or services exposed only within the infrastructure.

The vulnerability affects the open‑source video platform WWBN AVideo, specifically all releases 29.0 and earlier. Versions updated with commit 8d8fc0cadb425835b4861036d589abcea4d78ee8 contain the corrected protection.

The CVSS score of 8.6 indicates high severity for this SSRF flaw. No EPSS score is published, so the current exploitation probability is unknown, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote via the LiveLinks proxy endpoint; an attacker can trigger internal requests if the proxy is reachable from the Internet or from compromised internal hosts.