AVideo’s LiveLinks proxy validates URLs with the isSSRFSafeURL() function, which was vulnerable to IPv4‑mapped IPv6 addresses such as ::ffff:10.0.0.5. These addresses circumvent the safety check, allowing an attacker to cause the server to fetch any remote resource via curl. The result is an SSRF that can reach cloud metadata services, internal network hosts, and localhost endpoints, potentially exposing sensitive configuration data and providing a foothold for further attacks. The flaw is classified as CWE‑918, reflecting insufficient input validation on the server side and a high CVSS score of 8.6.

The vulnerability affects the open source video platform AVideo by WWBN, specifically versions up to and including 26.0. Versions 26.1 and later contain a patch that resolves the SSRF bypass. All installations of the affected releases that expose the unauthenticated /plugin/LiveLinks/proxy.php endpoint are susceptible.

The CVSS score of 8.6 indicates a high severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the flaw by sending an unauthenticated HTTP request to the LiveLinks/proxy.php endpoint with an IPv4‑mapped IPv6 URL, enabling internal network reconnaissance and potential lateral movement.