CVE-2026-100901: athlon1600 youtube-downloader stream.php stream server-side request forgery
A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Commit 6ffe823 'better security for public/stream.php' only added CURLOPTPROTOCOLS http/https restriction and MAXREDIRS cap, does not restrict destination host. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Does exploitation require an authenticated account or user interaction?
No. The supplied CVSS vector indicates no privileges are required and no user interaction is required, and the attack can be launched remotely.
Does commit 6ffe823 fully address the issue?
No. It restricts requests to HTTP and HTTPS and caps redirects, but it does not restrict the destination host. An attacker-controlled URL can therefore still target unrestricted hosts over those protocols.
How likely is active exploitation?
A public exploit is available, so the issue should be treated as practically exploitable rather than purely theoretical.