Server-Side Request Forgery (SSRF) in AVideo - #VU161914
Published: November 8, 2026
Vulnerability identifier: #VU161914
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:L/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated attacker to read internal HTTP responses and cloud instance metadata, including credentials, through AVideo.
The vulnerability exists due to incomplete validation of embedded IPv4 targets in IPv6 transition addresses by the LiveLinks proxy's SSRF guard. An unauthenticated attacker can submit a crafted URL to plugin/LiveLinks/proxy.php and retrieve the target's full response on deployments with IPv6 connectivity and compatible transition routing, such as NAT64.
Affected software
AVideo
Remediation
Install security update from vendor's website.
AVideo - update to 24.0