https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T11:15:04.451632+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-276936 EUVD-2026-276936 2026-10-16T11:15:04.454215+00:00 EUVD-2026-276936 https://cve.radiocsirt.org/vuln/fkie_cve-2026-33480 fkie_cve-2026-33480 2026-10-16T11:15:04.454261+00:00

WWBN AVideo is an open source video platform. In versions up to and including 26.0, the `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.

 https://cve.radiocsirt.org/vuln/ghsa-p3gr-g84w-g8hh GHSA-p3gr-g84w-g8hh — AVideo has a SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses in Unauthenticated LiveLinks Proxy 2026-10-16T11:15:04.454308+00:00

Affected: Packagist: wwbn/avideo

## Summary

The `isSSRFSafeURL()` function in AVideo can be bypassed using IPv4-mapped IPv6 addresses (`::ffff:x.x.x.x`). The unauthenticated `plugin/LiveLinks/proxy.php` endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services.

## Details

The `isSSRFSafeURL()` function in `objects/functions.php` (lines 4021-4169) implements SSRF protection with two separate check paths:

1. **IPv4 checks** (lines 4101-4134): Regex patterns matching dotted-decimal notation (`/^10\./`, `/^172\./`, `/^192\.168\./`, `/^127\./`, `/^169\.254\./`) 2. **IPv6 checks** (lines 4150-4166): Checks for `::1`, `fe80::/10` (link-local), and `fc00::/7` (unique local)

The gap: IPv4-mapped IPv6 addresses (`::ffff:0:0/96`) are not checked in either path. When a URL like `http://[::ffff:169.254.169.254]/` is provided:

``` // Line 4038: parse_url strips brackets from IPv6 host $host = parse_url($url, PHP_URL_HOST); // $host = "::ffff:169.254.169.254"

// Line 4079: filter_var recognizes it as valid IPv6, skips DNS resolution if (!filter_var($host, FILTER_VALIDATE_IP)) { $resolvedIP = gethostbyname($host); // SKIPPED } $ip = $host; // $ip = "::ffff:169.254.169.254"

// Lines 4101-4134: IPv4 regex checks DON'T match (not dotted-decimal) if (preg_match('/^169\.254\.\d{1,3}\.\d{1,3}$/', $ip)) // NO MATCH

// Lines 4150-4166: IPv6 checks do…