CVE-2026-82648

WWBN AVideo is affected by a server-side request forgery (SSRF) filter bypass in its isSSRFSafeURL function, which validates URLs before the server fetches them but fails to normalize NAT64 addresses written in hexadecimal form. A network attacker with low-privileged access (CVSS 4.0 PR:L) can submit a hex-encoded NAT64 address such as 64:ff9b::a9fe:a9fe — which maps to the metadata address 169.254.169.254 — to a URL-fetching feature, so the filter treats it as an allowed external address while the server actually connects to an internal destination. This lets the attacker reach cloud instance-metadata services and the server's own loopback interfaces, potentially harvesting credentials or instance data from metadata endpoints, which drives the high confidentiality impact in the 7.1 (High) CVSS 4.0 score. Any self-hosted WWBN AVideo deployment that exposes URL ingestion/fetch functionality is affected; exact affected and fixed version ranges were not provided in the available data. No public proof-of-concept, KEV listing, or confirmed in-the-wild exploitation is currently known, and EPSS assigns only a ~0.2% probability of exploitation in the next 30 days.

What to do: Upgrade AVideo to the latest vendor release once a patched build addressing isSSRFSafeURL is available (no fixed version number is specified in the available data). As interim mitigation, restrict the AVideo server's outbound access to 169.254.0.0/16, loopback ranges, and IPv6 NAT64-form representations of link-local/loopback addresses, and review server logs for low-privileged users submitting hex NAT64 URLs to fetch/ingest features.