CVE-2026-33480
WWBN AVideo is an open source video platform.
Published Mar 23, 2026 · updated Jun 17, 2026 · wwbn avideo
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in AVideo can be bypassed using IPv4-mapped IPv6 addresses ( ). The unauthenticated endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost services. Commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373 contains a patch.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Mar 23, 2026 · NIST NVD
Detected
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in AVideo can be bypassed using IPv4-mapped IPv6 addresses ( ). The unauthenticated endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost se
Jun 17, 2026 · NIST NVD
Updated
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in AVideo can be bypassed using IPv4-mapped IPv6 addresses ( ). The unauthenticated endpoint uses this function to validate URLs before fetching them with curl, but the IPv4-mapped IPv6 prefix passes all checks, allowing an attacker to access cloud metadata services, internal networks, and localhost se
Affected
- cpe wwbn/avideoversion unspecified
Sources
- CVE.orgVulnerability recordCVE-2026-33480
Official CVE identifier
cve.org - NIST NVDVulnerability recordCVE-2026-33480
WWBN AVideo is an open source video platform. In versions up to and including 26.0, the function in AVideo can be bypassed using IPv4-mapped IPv6 addresses ( ). The unauthenticated endpoint uses this function to valida
nvd.nist.gov