CVE-2026-81678: AVideo SSRF Guard Bypass via IPv6 Transition Addresses
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in transition address formats.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker who can send requests to the LiveLinks proxy endpoint can exploit the bypass. No user interaction or prior privileges are required.
What systems can an attacker reach through the vulnerable server?
The bypass can be used to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in NAT64, 6to4, or Teredo IPv6 transition address formats.
Which versions are affected?
AVideo versions before 24.0 are affected.
How can I determine whether my deployment is exposed?
Check whether the deployment runs a version earlier than 24.0 and whether its LiveLinks proxy endpoint is reachable by untrusted users. Those deployments may allow SSRF protections to be bypassed using IPv6 transition-format addresses.