CVE-2026-45619 — AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at mast…

CVE-2026-45619

AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post PUBLISHED

Description (CNA)

WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.

Affected (CNA)

Vendor / product	Versions
WWBN / AVideo	affected <= 29.0

CWE

CWE-367, CWE-918

References

https://github.com/WWBN/AVideo/security/advisories/GHSA-c3ch-22rq-xfwr

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.