VULNERABILITY INTELLIGENCE
CVE-2026-82648
CVSS score7.1 HIGH
EPSS probability0.32%
CISA KEVNot currently listed
Published2026-08-30
Last modified2026-09-02
CVSS vectorCVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N
Description
WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails to normalize NAT64 addresses written in hexadecimal form. Attackers can bypass SSRF protections by supplying hex-encoded NAT64 addresses like 64:ff9b::a9fe:a9fe to reach cloud metadata services and loopback interfaces.
Weakness classification
- CWE-20: Improper Input Validation