CVE-2026-45619: AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post
CVE-2026-43884 fix 603e7bf patched EpgParser.php and plugin/AI/receiveAsync.json.php to use urlgetcontents (redirect-safe). Neither uses the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPTRESOLVE. Six+ other call sites still discard $resolvedIP, opening DNS-rebinding TOCTOU.
Reference correct pattern at plugin/YPTWallet/YPTWallet.php:1071-1098:
php $resolvedIP = null; if (isSSRFSafeURL($url, $resolvedIP)) { curlsetopt($ch, CURLOPTRESOLVE, ["$h
Other sources
WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPTRESOLVE, opening DNS-rebinding TOCTOU.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AVideoto a version that resolves this vulnerability.Patch 603e7bf - Configuration
Update call sites in AVideo (including EpgParser.php and plugin/AI/receiveAsync.json.php) so that CURLOPT_RESOLVE uses the DNS-pinned IP returned via the $resolvedIP out-param from isSSRFSafeURL(). The referenced correct pattern is in plugin/YPTWallet/YPTWallet.php:1071-1098 (use $resolvedIP for DNS pinning) to prevent DNS-rebinding TOCTOU.
AVideo EpgParser.php / plugin/AI/receiveAsync.json.php isSSRFSafeURL() $resolvedIP out-param usage for CURLOPT_RESOLVE = Use the $resolvedIP out-param returned by isSSRFSafeURL() when setting CURLOPT_RESOLVE (do not discard it)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45619?
CVE-2026-45619 has a medium severity rating, indicating a notable risk that needs attention.
How do I fix CVE-2026-45619?
To fix CVE-2026-45619, update the WWBN/AVideo package to version 29.1 or later where the vulnerability is patched.
What vulnerabilities does CVE-2026-45619 expose?
CVE-2026-45619 exposes applications to potential DNS spoofing attacks due to the improper handling of DNS resolutions.
Which versions of WWBN/AVideo are affected by CVE-2026-45619?
CVE-2026-45619 affects WWBN/AVideo versions up to and including 29.0.
Is CVE-2026-45619 related to any recent security advisories?
Yes, CVE-2026-45619 is documented in recent security advisories highlighting its impact on DNS safety.