What is the CVSS score of CVE-2026-45619?

CVE-2026-45619 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

AVideo CVE-2026-45619

EUVD-2026-33308 MEDIUM

Time-of-check Time-of-use (TOCTOU) Race Condition (CWE-367)

2026-05-15 https://github.com/WWBN/AVideo

GHSA-c3ch-22rq-xfwr

Information Disclosure PHP

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 15, 2026 - 19:34 vuln.today

Analysis Generated

May 15, 2026 - 19:34 vuln.today

DescriptionGitHub Advisory

CVE-2026-43884 fix 603e7bf patched EpgParser.php and plugin/AI/receiveAsync.json.php to use url_get_contents (redirect-safe). Neither uses the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE. Six+ other call sites still discard $resolvedIP, opening DNS-rebinding TOCTOU.

Reference correct pattern at plugin/YPTWallet/YPTWallet.php:1071-1098:

php

$resolvedIP = null;
if (isSSRFSafeURL($url, $resolvedIP)) {
    curl_setopt($ch, CURLOPT_RESOLVE, ["$h

AnalysisAI

Time-of-check-time-of-use DNS rebinding in AVideo <= 29.0 allows remote unauthenticated attackers to bypass Server-Side Request Forgery (SSRF) protections and exfiltrate sensitive data from internal networks. The partial fix for CVE-2026-43884 in commit 603e7bf addressed only two call sites but left six or more locations discarding the DNS-pinning mechanism via CURLOPT_RESOLVE, enabling attackers to race DNS resolution between validation and HTTP request execution. No vendor-released patch identified at time of analysis. EPSS data not available for this CVE.

Technical ContextAI

AVideo is a PHP-based video streaming and sharing platform (composer package wwbn/avideo). The vulnerability stems from incomplete implementation of SSRF protections introduced in CVE-2026-43884. The codebase includes an isSSRFSafeURL() function that returns a resolved IP address via an out-parameter ($resolvedIP) intended for DNS pinning using PHP cURL's CURLOPT_RESOLVE option. This pinning prevents DNS rebinding attacks where an attacker controls a domain that resolves to a safe IP during validation but switches to an internal IP (e.g., 127.0.0.1, 10.x.x.x, 169.254.x.x) before the actual HTTP request executes. The root cause is CWE-367 (Time-of-Check Time-of-Use Race Condition). While the fix patched EpgParser.php and plugin/AI/receiveAsync.json.php to use url_get_contents (a redirect-safe wrapper), these and at least six other call sites fail to capture or apply the $resolvedIP parameter to curl_setopt with CURLOPT_RESOLVE, leaving a TOCTOU window. The correct implementation pattern exists at plugin/YPTWallet/YPTWallet.php:1071-1098 where $resolvedIP is properly applied to pin DNS resolution.

RemediationAI

No vendor-released patch identified at time of analysis - the fix for version 29.0+ remains incomplete per the GitHub advisory. Organizations must apply manual code-level remediation by auditing all isSSRFSafeURL() call sites and implementing DNS pinning via CURLOPT_RESOLVE. Specific steps: (1) Identify all PHP files calling isSSRFSafeURL($url, $resolvedIP) using grep or static analysis. (2) For each call site, verify that $resolvedIP is captured as the second parameter and subsequently applied to cURL handles via curl_setopt($ch, CURLOPT_RESOLVE, ["$hostname:$port:$resolvedIP"]). (3) Follow the reference implementation pattern at plugin/YPTWallet/YPTWallet.php lines 1071-1098 documented in the advisory. (4) Test each patched endpoint to confirm DNS resolution is pinned and does not follow rebinding during the request window. Compensating controls with trade-offs: Disable or restrict access to vulnerable plugins (EPG parser, AI async receiver, and four or more other unnamed modules) - this breaks legitimate external media ingestion and AI features. Implement egress firewall rules blocking AVideo server access to RFC1918 private ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost (127.0.0.0/8), link-local (169.254.0.0/16), and cloud metadata endpoints - this prevents internal pivoting but may disrupt legitimate integrations with internal services. Deploy Web Application Firewall rules to validate or sanitize URL parameters in plugin endpoints - effectiveness depends on identifying all vulnerable entry points. Monitor ongoing GitHub repository for a comprehensive patch release addressing all six or more unfixed call sites. Advisory URLs: https://github.com/WWBN/AVideo/security/advisories/GHSA-c3ch-22rq-xfwr.