CVE-2026-81678 in AVideo
Summary
by MITRE • 08/27/2026
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in transition address formats.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/27/2026
The vulnerability identified in AVideo versions prior to 24.0 represents a critical server-side request forgery flaw rooted in insufficient input validation within the isSSRFSafeURL function. This specific component is designed to sanitize URLs and prevent applications from making unauthorized requests to internal or external resources, a standard security control intended to mitigate SSRF attacks. However, the implementation fails to adequately parse and validate IPv6 transition address formats, specifically NAT64, 6to4, and Teredo encodings. These mechanisms are used to facilitate communication between IPv6-only networks and legacy IPv4 infrastructure by embedding IPv4 addresses within IPv6 packet structures. The security logic in AVideo does not correctly extract the embedded private IPv4 addresses from these complex formats, leading to a false sense of security where potentially malicious payloads appear valid because they conform to syntactically correct IPv6 standards rather than being flagged as invalid or dangerous IPv4 targets.
This technical deficiency allows unauthenticated attackers to bypass SSRF protections by leveraging the LiveLinks proxy endpoint. By encoding private IP addresses such as those in the 10.x.x.x, 172.16.x.x-172.31.x.x, or 192.168.x.x ranges into NAT64, 6to4, or Teredo formats, an attacker can trick the server into treating these requests as legitimate external traffic. Consequently, the application proceeds to forward the request to internal services that are typically isolated from public access. This capability is particularly dangerous because it enables attackers to interact with cloud metadata endpoints, such as those found in AWS EC2 instance metadata service or Azure managed identity endpoints. Accessing these endpoints can lead to the compromise of long-term credentials and temporary security tokens stored within the instance metadata, effectively granting the attacker full control over the underlying infrastructure without needing valid authentication credentials for the application itself.
The operational impact of this vulnerability extends beyond simple data exfiltration from internal services. By accessing cloud metadata stores, attackers can retrieve sensitive configuration details, API keys, and service account secrets that are essential for maintaining the integrity and confidentiality of the broader system environment. This escalation path transforms a local SSRF issue into a severe infrastructure compromise risk. Furthermore, because the vulnerability exists in an unauthenticated endpoint, it requires no prior access or user interaction to exploit, significantly lowering the barrier for entry for automated scanning tools and opportunistic attackers. The ability to reach internal services also opens avenues for lateral movement within the network, allowing adversaries to probe other systems that may have weaker security postures than the initial target.
To mitigate this risk, organizations running AVideo must upgrade immediately to version 24.0 or later, where the isSSRFSafeURL function has been patched to correctly handle and reject embedded IPv4 addresses within transition formats. Until an update can be applied, administrators should implement strict network-level controls such as firewall rules that block outbound connections from the application server to private IP ranges and cloud metadata endpoints. Additionally, deploying a web application firewall with specific signatures for SSRF attempts involving encoded IPs or unusual URL structures can provide an additional layer of defense. It is also advisable to review access logs for any suspicious requests targeting internal addresses via proxy endpoints to detect potential exploitation attempts in real time. This vulnerability aligns with CWE-918, which describes Server-Side Request Forgery flaws resulting from insufficient validation of user-supplied input, and maps to the ATT&CK technique T1502.001, known as Steal or Forge Web Credentials via Cloud Metadata APIs, highlighting its potential for credential theft in cloud-native environments.