A critical server-side request forgery vulnerability in WWBN AVideo versions 26.0 and earlier allows unauthenticated attackers to probe internal networks and access sensitive cloud metadata services.

The application fails to properly sanitize URL inputs within the isSSRFSafeURL function, as it does not account for IPv4-mapped IPv6 address formats. An unauthenticated attacker can exploit this flaw via the plugin/LiveLinks/proxy.php endpoint to force the server to perform unauthorized requests against internal infrastructure.

Successful exploitation allows an attacker to bypass perimeter defenses and interact with internal-only services, including cloud instance metadata endpoints that may contain sensitive credentials. Given the CVSS score of 8.6, this vulnerability poses a high risk of unauthorized information disclosure and potential lateral movement within the network. Organizations relying on AVideo for video hosting may face significant data breaches if internal management interfaces or cloud service APIs are exposed.

Immediate Action: Since no official patch release is currently listed, administrators should immediately restrict network access to the AVideo instance or disable the affected LiveLinks plugin until a vendor-supplied fix is available.

Proactive Monitoring: Review web server access logs for anomalous requests to plugin/LiveLinks/proxy.php, specifically looking for URL parameters containing IPv6-formatted addresses or internal IP ranges.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block or inspect requests targeting the proxy.php endpoint and filter out suspicious URL schemes or non-standard address formats.

Public Exploit Available: Unknown.

This vulnerability represents a significant security risk due to the potential for unauthenticated internal reconnaissance and data theft. While a code-level fix is available via the referenced GitHub commit, organizations must prioritize blocking access to the vulnerable endpoint immediately to prevent exploitation while awaiting an official package update.