What’s Vulnerable › Vulnerabilities

CVE-2026-81678: AVideo SSRF Guard Bypass via IPv6 Transition Addresses

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-27 · updated 2026-08-29
• Weakness: CWE-918

Description

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in transition address formats.

Affected products

• WWBN AVideo: before 24.0 — fixed in 24.0

How to fix

Upgrade to a fixed version: WWBN AVideo 24.0. Check the vendor advisory for mitigations.

References

• https://github.com/WWBN/AVideo/security/advisories/GHSA-474r-333v-6p93
• https://www.vulncheck.com/advisories/avideo-ssrf-guard-bypass-via-ipv6-transition-addresses
• https://github.com/WWBN/AVideo/security/advisories/GHSA-474r-333v-6p93

Get alerted when CVE-2026-81678 or the next vulnerability affects your stack