Executive brief
AVideo is a video hosting and streaming platform. The LiveLinks proxy endpoint fails to properly validate URLs containing IPv6 transition address formats (NAT64, 6to4, Teredo), allowing unauthenticated attackers to bypass SSRF protections and reach internal services and cloud metadata endpoints. On cloud deployments, this enables attackers to steal IAM credentials, API tokens, and internal data without authentication.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the isSSRFSafeURL() function within objects/functions.php. The root cause is incomplete normalization of IPv6 addresses before SSRF validation: the function only extracts IPv4 addresses from the ::ffff: IPv4-mapped format but fails to handle NAT64 (64:ff9b::/96), 6to4 (2002::/16), and Teredo (2001::/32) transition formats that embed IPv4 payloads. An unauthenticated attacker can send requests to the LiveLinks proxy endpoint (/plugin/LiveLinks/proxy.php) with a URL encoded in one of these transition formats targeting private addresses (e.g., 169.254.169.254 for cloud metadata). The malformed URL passes validation, curl resolves it to the embedded IPv4 address, and the full response body is returned to the attacker. Patches are available in version 24.0 and later.
Affected products
- WWBN AVideo before 24.0
Timeline
- 2026-08-12: disclosed
- 2026-08-27: advisory