What is GHSA-wcx4-rhpw-3mww?

GHSA-wcx4-rhpw-3mww is a security advisory published by GitHub Security Advisories with High severity. Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated...

Which CVE IDs does GHSA-wcx4-rhpw-3mww cover?

GHSA-wcx4-rhpw-3mww covers the following CVE IDs: CVE-2026-126379. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-wcx4-rhpw-3mww?

GHSA-wcx4-rhpw-3mww has a CVSS v3 base score of 7.6, published by GitHub Security Advisories.

GHSA-wcx4-rhpw-3mwwHighCVSS 7.6

Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated...

Vendor

GitHub Security Advisories

Published

November 13, 2026

Last Modified

November 13, 2026

🔗 CVE IDs covered (1)

CVE-2026-126379 →

📋 Description

Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.

🔗 References (4)

https://github.com/givanz/Vvveb/security/advisories/GHSA-42hc-694f-hcqm
https://nvd.nist.gov/vuln/detail/CVE-2026-126379
https://www.vulncheck.com/advisories/vvveb-1.0.8.6-ssrf-via-oembed-proxy-dns-rebinding
https://github.com/advisories/GHSA-wcx4-rhpw-3mww