Skip to content
Threat Feed
Subscribe
critical advisory

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Encoding

WWBN AVideo is vulnerable to a Server-Side Request Forgery (SSRF) bypass in the isSSRFSafeURL function due to improper normalization of hex-encoded NAT64 addresses.

CVE search metadata

CVE search record: CVE-2026-82648. Severity: high. CVSS: 7.1. KEV: no. Product: AVideo, AVideo (e01e41ecc and earlier), AVideo (<= e01e41ecc), AVideo (<= 9c39d8c8), AVideo (<= c3edcc274c389816d434acadac07ee78eaf330c1), AVideo (<= commit c3edcc274c389816d434acadac07ee78eaf330c1), AVideo (<= 29.0), AVideo (<= commit e01e41ecc). Brief: WWBN AVideo SSRF Filter Bypass via NAT64 Hex Encoding. Brief link: https://feed.craftedsignal.io/briefs/2026-08-wwbn-avideo-ssrf/

What's new

  • 1. added coverage for AVideo (<= commit e01e41ecc) Sep 17, 13:57 via nvd
  • 2. added coverage for AVideo (<= 29.0) Sep 17, 03:52 via nvd
  • 3. added detection rule: Detect CVE-2026-92582 Exploitation - CSRF Attempt on videoAddNew.json.php Sep 16, 23:52 via nvd
  • 4. added coverage for AVideo (<= c3edcc274c389816d434acadac07ee78eaf330c1) Sep 10, 15:11 via nvd
  • 5. added coverage for AVideo (<= commit c3edcc274c389816d434acadac07ee78eaf330c1) Sep 10, 15:11 via nvd

WWBN AVideo contains a server-side request forgery (SSRF) vulnerability identified as CVE-2026-82648, located within the isSSRFSafeURL function. The vulnerability stems from a failure to correctly normalize NAT64 addresses when they are presented in a hexadecimal format. Because the function does not account for these specific representations, attackers can bypass existing URL filtering protections. By crafting malicious requests containing NAT64 addresses such as 64:ff9b::a9fe:a9fe, an unauthorized actor can force the application to perform requests against restricted internal resources, including cloud metadata services (e.g., 169.254.169.254) and local loopback interfaces. This flaw is particularly significant in cloud-hosted environments where metadata services store sensitive IAM credentials or instance configuration details. Successful exploitation allows an attacker to interact with internal network segments that are otherwise protected from external reach, potentially resulting in credential theft or further lateral movement within the hosting infrastructure.

Impact

Successful exploitation allows unauthenticated attackers to bypass SSRF protections, enabling unauthorized interaction with internal cloud metadata services and local network resources. This can result in the exfiltration of instance-level credentials, sensitive configuration data, or internal system exploitation, compromising the confidentiality and integrity of the AVideo server instance.

Recommendation

  • Audit web application logs for HTTP requests containing unusual IPv6 NAT64 or hex-encoded address strings directed at internal hostnames or IP ranges.
  • Implement a secondary validation layer at the network edge or application-level proxy to verify that requests originating from AVideo are not destined for reserved or private IP ranges, regardless of the encoding used in the URL.
  • Monitor for unauthorized access attempts to local cloud metadata services from the AVideo application host.
  • Review all AVideo instance configurations to ensure they are updated to the latest vendor-provided patches that resolve CVE-2026-82648.

Immediate actions

Review server access logs for requests containing hex-encoded IPv6 addresses targeting internal metadata endpoints

SOC 24h

Mitigations

Patch AVideo to the latest version as recommended by WWBN

immediate IT Operations

CVE-2026-82648

Detection coverage 7

Detect CVE-2026-82644 Exploitation - Brute Force Bypass via User-Agent Manipulation

high

Detects potential brute-force attempts on login endpoints by identifying high-frequency POST requests with missing or common bot User-Agent strings, which characterize the CVE-2026-82644 bypass vector.

sigma tactics: credential_access techniques: T1110.001 sources: webserver

Detect Exploitation of CVE-2026-84479 - Suspicious User-Agent Usage in AVideo

high

Detects potential exploitation of CVE-2026-84479 where an attacker spoofs the User-Agent to bypass AVideo security controls.

sigma tactics: credential_access, initial_access techniques: T1550.002 sources: webserver

Detect CVE-2026-84478 Exploitation - Path Traversal in AVideo API

high

Detects exploitation attempts against the WWBN AVideo get_api_login_code endpoint using path traversal sequences in the code parameter

sigma tactics: initial_access techniques: T1083, T1190 sources: webserver

Detect CVE-2026-86189 Exploitation Attempt - Path Traversal in AVideo

critical

Detects exploitation attempts against notify.ffmpeg.json.php using path traversal sequences in the avideoRelativePath parameter.

sigma tactics: initial_access techniques: T1190 sources: webserver

Detect CVE-2026-86729 Exploitation - High-Frequency Access to get_api_preauthorize

high

Detects potential brute-force attempts against the unthrottled get_api_preauthorize API endpoint by identifying an anomalous volume of POST requests to the plugin path.

sigma tactics: credential_access techniques: T1110.001 sources: webserver

Detect CVE-2026-86720 Exploitation - Unauthorized Access to resendRestreamer.json.php

high

Detects potential exploitation of CVE-2026-86720 by monitoring for repeated POST requests to the vulnerable script that may indicate parameter manipulation.

sigma tactics: initial_access techniques: T1595 sources: webserver

Detect CVE-2026-92582 Exploitation - CSRF Attempt on videoAddNew.json.php

high

Detects exploitation attempts against CVE-2026-92582 by identifying HTTP requests to videoAddNew.json.php that include both user and pass parameters in the query string, which trigger the CSRF protection bypass.

sigma tactics: initial_access sources: webserver

Detection queries are available on the platform. Get full rules →