6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45619

CVE-2026-45619: AVideo CVE-2026-43884 incomplete fix - `isSSRFSafeURL()` call sites still discard the `$resolvedIP` out-param at master HEAD post

WWBN AVideo is an open source video platform. In 29.0 and earlier, EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations do not use the $resolvedIP out-param of isSSRFSafeURL() for DNS pinning via CURLOPT_RESOLVE, opening DNS-rebinding TOCTOU.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45619

CVE-2026-45619:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
WWBN/AVideo	composer	<= 29.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is an incomplete fix for a Server-Side Request Forgery (SSRF) vulnerability. The original fix, commit 603e7bf, replaced calls to isSSRFSafeURL followed by file_get_contents with a single call to url_get_contents. However, as stated in the security advisory, this fix is incomplete because url_get_contents itself does not use the $resolvedIP output parameter from isSSRFSafeURL to perform DNS pinning. This leaves the application vulnerable to Time-of-check Time-of-use (TOCTOU) race conditions via DNS rebinding.

The analysis of commit 603e7bf reveals two locations where this incomplete fix was applied:

The parseUrl() function in objects/EpgParser.php.
The script plugin/AI/receiveAsync.json.php.

Both of these now use url_get_contents to fetch remote content based on a provided URL, and are thus vulnerable. The advisory mentions that there are at least six other similar vulnerabilities in the codebase, but without the ability to search the entire repository, this analysis is limited to the functions explicitly mentioned and patched in the provided commit. The root cause is the lack of DNS pinning when making HTTP requests to user-supplied URLs.

Vulnerable functions

EpgParser.parseUrl

objects/EpgParser.php

The function `parseUrl` in `EpgParser.php` was patched to use `url_get_contents` to fetch content from a URL. However, the advisory states this is an incomplete fix as `url_get_contents` does not implement DNS pinning, making it vulnerable to SSRF via DNS rebinding (TOCTOU).

receiveAsync.json.php

plugin/AI/receiveAsync.json.php

The script `plugin/AI/receiveAsync.json.php` was patched to use `url_get_contents` to fetch an image from a user-supplied URL. This is an incomplete fix as `url_get_contents` does not use DNS pinning, leaving it vulnerable to SSRF via DNS rebinding (TOCTOU).

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.