CVEvulnerability

CVE-2026-45619

6.5 MEDIUM Published 2026-05-29 Modified 2026-07-21 Official page ↗
Status
Analyzed
Published
2026-05-29
Last modified
2026-07-21
Assigner
[email protected]
CVSS 3.1 ([email protected])
6.5 MEDIUM — CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N
Weaknesses
CWE-367, CWE-918

Description

WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.

Affected configurations

• wwbn avideo (<= 29.0)

Related

Weakness · CWE (2)

  • CWE-367 Time-of-check Time-of-use (TOCTOU) Race Condition weakness
  • CWE-918 Server-Side Request Forgery weakness

References