CVE-2026-82648: Improper Input Validation in WWBN AVideo

CVE-2026-82648 describes a vulnerability in WWBN AVideo where the isSSRFSafeURL function does not properly normalize NAT64 addresses when they are represented in hexadecimal form. This improper input validation allows attackers to bypass server-side request forgery (SSRF) protections by supplying hex-encoded NAT64 addresses such as 64:ff9b::a9fe:a9fe. Exploiting this bypass can enable attackers to reach sensitive internal resources like cloud metadata services and loopback interfaces that are normally protected by SSRF filters.

The vulnerability allows attackers with low privileges and partial attack complexity to bypass SSRF protections, potentially accessing sensitive internal network resources such as cloud metadata services and loopback interfaces. This could lead to information disclosure or further attacks leveraging internal services. The CVSS 4.0 score of 7.1 indicates a high severity impact with high vector complexity and partial user interaction not required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, users should monitor vendor communications for updates. Until a fix is available, consider additional network-level protections to restrict access to sensitive internal services and review SSRF filter configurations for robustness against NAT64 hexadecimal address encodings.