In AVideo version 29.0 and earlier, several request handlers omit the resolvedIP output of isSSRFSafeURL, meaning DNS pinning via CURLOPT_RESOLVE does not occur. This oversight creates a TOCTOU window that allows an attacker to trick the server into resolving a domain to an internal IP address. If successful, the attacker can instruct the server to make HTTP requests to private resources, bypassing normal access controls.

The affected product is WWBN AVideo, specifically releases 29.0 and older. Files such as EpgParser.php, plugin/AI/receiveAsync.json.php, and other relevant code paths are impacted. Any instance running these versions is vulnerable.

The CVSS score of 6.5 indicates a moderate severity. The EPSS score is not available, so the exploitation likelihood is uncertain, and the vulnerability is not currently listed in CISA KEV. Attackers would need to control a domain they can resolve to an internal IP and target the application’s request handlers; thus the exploit is primarily remote and does not require authentication. Because the flaw enables SSRF to internal services, it carries potential confidentiality or integrity risks for internal data.