CVE-2026-81678— AVideo SSRF Guard Bypass via IPv6 Transition Addresses
Quick assessment
Affected
WWBN AVideo
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
AVideo 24.0 之前的版本中， 函数存在服务器端请求伪造（SSRF）漏洞，该函数未能从 NAT64、6to4 和 Teredo 等 IPv6 过渡地址格式中提取嵌入的 IPv4 地址。未认证的攻击者可以通过 LiveLinks 代理端点绕过 SSRF 防护机制，通过将私有 IPv4 目标编码为过渡地址格式，从而访问内部服务和云元数据端点。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-81678
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
AVideo SSRF Guard Bypass via IPv6 Transition Addresses
Source: CVE Program / CVE List V5
Vulnerability Description
AVideo before 24.0 contains a server-side request forgery vulnerability in the isSSRFSafeURL function that fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass SSRF protections via the LiveLinks proxy endpoint to reach internal services and cloud metadata endpoints by encoding private IPv4 targets in transition address formats.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-81678
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-81678
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-81678 (2)
-
-
🔗 AVideo SSRF Guard Bypass via IPv6 Transition Addresses | Advisories | VulnCheck third-party-advisory
IV. Related Vulnerabilities
Same product: AVideo
-
CVE-2026-59808
AVideo Authentication Bypass via Unkeyed Video Hash Disclosu -
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-58003
WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.j -
CVE-2026-58002
WWBN AVideo Authorization Bypass via Users_affiliations add. -
CVE-2026-58001
WWBN AVideo Cross-Site Request Forgery via videoEditLight.ph
Same vendor: WWBN
-
CVE-2026-59808
AVideo Authentication Bypass via Unkeyed Video Hash Disclosu -
CVE-2026-59256
WWBN AVideo Unbound Token Authorization Bypass via Gallery -
CVE-2026-58003
WWBN AVideo Cross-Site Request Forgery via releaseVideoNow.j -
CVE-2026-58002
WWBN AVideo Authorization Bypass via Users_affiliations add. -
CVE-2026-58001
WWBN AVideo Cross-Site Request Forgery via videoEditLight.ph
Same weakness: CWE-918
-
CVE-2026-81848
cyberchitta scrapling-fetch-mcp _fetcher.py s_fetch_pattern -
CVE-2026-55758
CC: Tweaked: Incomplete fix for GHSA-5jh9-2h63-pw4q: RFC 821 -
CVE-2026-75871
Server-Side Request Forgery (SSRF) in GitLab AI Gateway -
CVE-2026-19889
Server-Side Request Forgery (SSRF) in GitLab AI Gateway -
CVE-2026-81093
Apify Actors MCP Server before 0.9.12 Server-Side Request Fo
V. Comments for CVE-2026-81678
No comments yet