TikTok Video Downloader EUVD-2026-104207

Exploitation requires the attacker to hold an active man-in-the-middle position on the network path between the server running TikTok-Video-Downloader-PHP and the remote HTTPS endpoints it contacts (TikTok APIs/CDN). The vulnerable condition is default behavior in affected revisions: index.php issues cURL requests with CURLOPT_SSL_VERIFYPEER and CURLOPT_SSL_VERIFYHOST both disabled, so any forged or invalid certificate is accepted without a configuration change. Limiting factors: no user interaction or authentication is needed (PR:N/UI:N), but the MITM prerequisite makes the attack high-complexity (AC:H) and opportunistic rather than widely exploitable; impact is confined to integrity of the fetched upstream data, with no confidentiality or availability effect per the vendor vector.

This is a genuine but low-priority defect. The source-code evidence confirms the root cause unambiguously: four cURL call sites in index.php set CURLOPT_SSL_VERIFYHOST and CURLOPT_SSL_VERIFYPEER to false, disabling TLS certificate validation (CWE-295). The vendor's CVSS 4.0 vector (6.3) scores AV:N/AC:H/AT:N/PR:N/UI:N with only VI:L and no confidentiality or availability impact, which is consistent with a man-in-the-middle integrity issue rather than direct code execution. The AC:H rating and the description's explicit note that 'exploitation is known to be difficult' reflect the real-world precondition: an attacker must already occupy a privileged network position between the server and TikTok's endpoints. There is no EPSS score, no CISA KEV listing, and no public exploit code referenced in the input - exploitation status is therefore 'no public exploit identified at time of analysis.' The 'Information Disclosure' tag mildly conflicts with the vendor vector (VC:N, i.e., no confidentiality impact scored), but this is a severity-interpretation nuance, not a confirmed exploitation signal. Net: a real, patch-worthy flaw with low realistic risk because exploitation requires MITM positioning and yields only limited integrity impact.

An attacker positioned on the network path between the vulnerable server and the upstream TikTok/CDN endpoints (e.g., a malicious Wi-Fi hop, compromised router, or DNS/ARP spoofing) presents a forged TLS certificate. Because the application disables peer and host verification in its cURL requests, the forged certificate is accepted, letting the attacker intercept or tamper with the fetched video content and metadata. No public exploit code is identified in the provided data, and the attack requires high complexity due to the needed MITM position.