WWBN AVideo’s isSSRFSafeURL() function fails to validate redirects, permitting an attacker to supply a URL that the application will follow to an internal endpoint, such as the instance’s cloud‑metadata service. An attacker can leverage this to retrieve data that should be protected, potentially exposing infrastructure details and privileged information. The weakness is a classic SSRF flaw that can lead to data exfiltration and further internal compromise.

The flaw is present in WWBN AVideo versions up to and including 29.0. Users running these or older releases are at risk until the fix from commit 603e7bf77a835584387327e35560262feb075db3 is applied or a newer version is installed.

The CVSS score of 7.7 indicates a high impact vulnerability; the EPSS score is not available, and it is not in CISA’s KEV catalog, but the lack of mitigation in the affected releases makes exploitation straightforward. The likely attack path involves an unauthenticated or authenticated user submitting a malicious URL to the vulnerable endpoints (plugin/AI/receiveAsync.json.php or objects/EpgParser.php). The application then follows a 302 redirect to a target such as http://169.254.169.254/latest/meta-data/ and re‑retrieves the payload without re‑applying SSRF checks. This enables access to internal services that are normally inaccessible from the public internet.