The vulnerability resides in the SSRF guard that incorrectly excludes the RFC 8215 NAT64 local‑use prefix 64:ff9b:1::/48. An unauthenticated Lua user can issue http.request or http.websocket to an address within that prefix, causing the server to treat it as a private IPv6 address and connect to loopback, RFC 1918, cloud metadata or other internal services. This flaw is a classic server‑side request forgery (CWE‑918) that allows the attacker to reach internal endpoints, discover network secrets, and potentially inject malicious payloads via the Minecraft environment.

Affected product is the CC‑Tweaked mod for Minecraft, all versions prior to 1.120.0. The fix was introduced in release 1.120.0.

The CVSS base score of 6.9 indicates a moderate severity issue. There is no EPSS data and the vulnerability is not yet listed in the CISA KEV catalog. The attack requires that an attacker has the ability to execute arbitrary Lua code on the server, which can be obtained by being a player on a shared server or by compromising a user account. Once that privilege is achieved, the attack path is straightforward: send a crafted http.request to a 64:ff9b:1::/48 address to reach localhost or internal APIs. Therefore, the exploitability is relatively high in environments where untrusted Lua execution is permitted.