CVE-2026-126379
HIGH
NVD
CVSS Score
7.6
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass DNS pinning by requesting non-443 URLs. Attackers can supply a rebinding hostname to the editor oEmbedProxy url parameter to read loopback services, internal panels, and cloud metadata credentials.