Executive brief
WWBN AVideo is a video hosting and streaming platform. The application contains a security filter designed to prevent attackers from accessing internal services and cloud metadata, but the filter can be bypassed using alternative ways to write IPv6 addresses. An authenticated attacker with upload privileges can use this bypass to fetch sensitive data from internal services or cloud metadata endpoints, which can then be accessed through the application's thumbnail feature.
Technical details
The vulnerability is an input validation bypass (CWE-20) in the isSSRFSafeURL() function within objects/functions.php. The function attempts to normalize NAT64 addresses (64:ff9b::/96) to their embedded IPv4 form using a regex pattern that only matches the dotted-decimal notation (64:ff9b::169.254.169.254), but fails to recognize equivalent hex-only spellings (64:ff9b::a9fe:a9fe). Since PHP's FILTER_VALIDATE_IP with FILTER_FLAG_NO_PRIV_RANGE flags does not recognize NAT64 as reserved, hex-form addresses bypass the check and reach internal/loopback targets. The vulnerability is exposed through the aVideoEncoderReceiveImage.json.php endpoint, which accepts URL parameters and fetches content from them; it requires authentication and upload privileges but allows reading arbitrary internal services via redirect chains. Patches are not yet available as of the advisory date.
Affected products
- WWBN AVideo current HEAD (e01e41ecc) and earlier
Timeline
- 2026-08-14: disclosed: GitHub Security Advisory published
- 2026-08-30: advisory: NVD and VulnCheck advisory published