CVE-2026-82648

HIGH 7.1

WWBN AVideo SSRF Filter Bypass via NAT64 Hex Address

CVSS Score

7.1

EPSS Score

0.0%

EPSS Percentile

0th

WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud metadata services and loopback interfaces.

CWE	CWE-20
Vendor	wwbn
Product	avideo
Published	Aug 30, 2026

Stay Ahead of the Next One

Get instant alerts for wwbn avideo

Be the first to know when new high vulnerabilities affecting wwbn avideo are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Affected Versions

WWBN / AVideo

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/WWBN/AVideo/security/advisories/GHSA-88jm-rxg9-3v5r vulncheck.com: https://www.vulncheck.com/advisories/wwbn-avideo-ssrf-filter-bypass-via-nat64-hex-address

Credits

🔍 rajivraj