CVE-2026-81678

HighCVSS 7.5

Published: 27/08/2026(UTC)Updated: 27/08/2026(UTC)Translated: 27/08/2026(UTC)NVD NIST

Summary

AVideo before version 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints.

Risk Assessment

Bypassing SSRF protections may allow an attacker to access internal resources and cloud credentials, posing a serious threat to infrastructure.

Recommendation

Upgrade AVideo to version 24.0 or later, which properly handles IPv6 transition addresses.

Original NVD description (English source)

AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in transition address formats.