CVE-2026-81678

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 24.0

Description An issue exists in the isSSRFSafeURL() function where it fails to extract embedded IPv4 addresses from NAT64, 6to4, and Teredo IPv6 transition address formats. Unauthenticated attackers can bypass protections via the LiveLinks proxy endpoint to access internal services and cloud metadata endpoints by encoding private IPv4 targets within these transition address formats. Server-Side Request Forgery (SSRF) is a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Recommendations Update to version 24.0 or later. As a temporary mitigation, restrict access to the LiveLinks proxy endpoint.