Is CVE-2026-64626 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-64626?

CVE-2026-64626 has a CVSS v3 severity of MEDIUM (6.4).

Back

CVE-2026-64626

Description

AVideo versions from commit 0dbadbca through latest master contain a server-side request forgery vulnerability in the encoder download-by-URL flow due to an unpinned retry fallback that bypasses DNS pinning validation. An authenticated attacker can supply a downloadURL that redirects to an internal address, causing the unpinned retry to follow the redirect and reach internal targets for blind SSRF attacks.