AVideo CVE-2026-81678

Exploitation requires that the AVideo instance be reachable over the network and that the LiveLinks proxy feature be operational (it appears to be a standard component, not a non-default option, based on the description). No authentication is required - the CVSS vector confirms PR:N. The attacker must be able to send HTTP requests to the LiveLinks endpoint. The meaningful limiting factor is deployment context: exploitation yields access only to services reachable from the AVideo server's network perspective, so the impact is bounded by what internal or metadata endpoints are co-located or adjacent. On isolated on-premises deployments with no internal services, practical impact is lower. On cloud instances where IMDSv1 is enabled, impact is substantially higher. There is no required user interaction and no indication of a non-default configuration gate - the vulnerable code path is in a general-purpose URL validation function invoked by the proxy.

The CVSS 4.0 base score of 6.9 reflects an unauthenticated, low-complexity network attack with no user interaction required (AV:N/AC:L/AT:N/PR:N/UI:N), which correctly captures the ease of exploitation. The impact metrics show no direct vulnerable-system confidentiality loss (VC:N) but subsequent-system impact across confidentiality, integrity, and availability at Low severity (SC:L/SI:L/SA:L), consistent with SSRF reaching internal services whose exposure varies by deployment. The real-world risk is context-dependent: cloud-hosted AVideo instances face the highest exposure because cloud metadata endpoints (AWS IMDSv1, GCP metadata server) are reachable via SSRF and may yield IAM credentials that elevate the effective impact well beyond what the base score conveys. On-premises deployments risk lateral movement to adjacent internal services. No EPSS data was provided in the source intelligence, and KEV status is not confirmed, suggesting exploitation is not yet widespread - though the bypass technique is well-understood and the attack surface (unauthenticated proxy endpoint) is straightforward to discover. Organizations running self-hosted AVideo as part of infrastructure with co-located sensitive internal services should treat this with urgency regardless of instance size.

An unauthenticated attacker sends an HTTP request to the AVideo LiveLinks proxy endpoint specifying a destination URL encoded as a NAT64 IPv6 address (e.g., 64:ff9b::a9fe:a9fe representing 169.254.169.254). The isSSRFSafeURL guard evaluates the address as a legitimate IPv6 address, bypasses the private-range blocklist, and the AVideo server fetches the cloud metadata endpoint, returning the response - potentially including IAM role credentials - to the attacker. No proof-of-concept code has been publicly identified, but the IPv6 transition encoding technique is well-documented and the LiveLinks proxy endpoint is likely discoverable through standard application mapping.