WWBN AVideo SSRF Filter Bypass via NAT64 Hex Encoding

WWBN AVideo contains a server-side request forgery (SSRF) vulnerability identified as CVE-2026-82648, located within the isSSRFSafeURL function. The vulnerability stems from a failure to correctly normalize NAT64 addresses when they are presented in a hexadecimal format. Because the function does not account for these specific representations, attackers can bypass existing URL filtering protections. By crafting malicious requests containing NAT64 addresses such as 64:ff9b::a9fe:a9fe, an unauthorized actor can force the application to perform requests against restricted internal resources, including cloud metadata services (e.g., 169.254.169.254) and local loopback interfaces. This flaw is particularly significant in cloud-hosted environments where metadata services store sensitive IAM credentials or instance configuration details. Successful exploitation allows an attacker to interact with internal network segments that are otherwise protected from external reach, potentially resulting in credential theft or further lateral movement within the hosting infrastructure.

Impact

Successful exploitation allows unauthenticated attackers to bypass SSRF protections, enabling unauthorized interaction with internal cloud metadata services and local network resources. This can result in the exfiltration of instance-level credentials, sensitive configuration data, or internal system exploitation, compromising the confidentiality and integrity of the AVideo server instance.

Recommendation

• Audit web application logs for HTTP requests containing unusual IPv6 NAT64 or hex-encoded address strings directed at internal hostnames or IP ranges.
• Implement a secondary validation layer at the network edge or application-level proxy to verify that requests originating from AVideo are not destined for reserved or private IP ranges, regardless of the encoding used in the URL.
• Monitor for unauthorized access attempts to local cloud metadata services from the AVideo application host.
• Review all AVideo instance configurations to ensure they are updated to the latest vendor-provided patches that resolve CVE-2026-82648.