CVE-2026-81678: Server-Side Request Forgery (SSRF) in WWBN AVideo
Description
AVideo before version 24.0 contains a server-side request forgery (SSRF) vulnerability in the isSSRFSafeURL function. This function fails to properly extract embedded IPv4 addresses from certain IPv6 transition address formats (NAT64, 6to4, Teredo). As a result, unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to access internal services and cloud metadata endpoints by encoding private IPv4 targets in these transition address formats. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
CVSS v4.0
Score 6.9medium
Affected software
WWBN
AVideo
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SSRF vulnerability in AVideo versions prior to 24.0 arises from improper handling of IPv6 transition address formats in the isSSRFSafeURL function. Attackers can exploit this by encoding private IPv4 addresses within NAT64, 6to4, or Teredo IPv6 addresses to bypass SSRF protections and reach internal or cloud metadata services through the LiveLinks proxy endpoint. This flaw allows unauthenticated remote attackers to perform SSRF attacks, potentially exposing sensitive internal resources.
Potential Impact
An unauthenticated attacker can bypass SSRF protections and use the LiveLinks proxy endpoint to access internal services and cloud metadata endpoints. This could lead to unauthorized information disclosure or further attacks leveraging internal network access. The vulnerability is rated medium severity with a CVSS score of 6.9.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or workaround is currently documented. Until a patch is available, restrict access to the LiveLinks proxy endpoint if possible and monitor for suspicious usage patterns related to SSRF attempts.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-27T11:11:30.933Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a906bb2acd9273b4983a18c
Added to database: 08/27/2026, 16:54:10 UTC
Last enriched: 09/10/2026, 04:38:19 UTC
Last updated: 10/10/2026, 06:48:19 UTC
Views: 75
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.