An authenticated user can configure a donation‑notification webhook URL that points to an internal or loopback address. When another user donates, the AVideo server performs a curl POST to this unvalidated URL, enabling the attacker to send requests to otherwise inaccessible internal services. The weakness is a blind SSRF, defined by CWE‑918: an attacker can trigger internal network traffic without receiving any response data back. The impact is limited to the ability to reach internal hosts, potentially exposing configuration, credentials, or other sensitive internal information.

WWBN AVideo, versions up to 29.0. The vulnerability exists across all installations of AVideo before the fix commit aaacd48f29f1ff71d1eb5fc81d37605f593cefa9.

The CVSS score of 5.4 indicates medium severity, and the EPSS score is not available, so the exploitation probability is unclear. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to create an authenticated account to set a malicious webhook, then have or create a second account to trigger a donation. Both conditions are achievable in compromised or shared environments, making the risk moderate. The attacker can target internal metadata or services like 127.0.0.1, 169.254.169.254, or other RFC1918 ranges; redirect bypass via CURLOPT_FOLLOWLOCATION further increases reach.