Quick answers
- Is CVE-2026-45619 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-45619 being exploited in the wild.
- How severe is CVE-2026-45619?
- Medium severity, with a CVSS score of 6.5, published 29 May 2026.
- Which products and versions are affected?
- wwbn/avideo (Packagist) <= 29.0, ECOSYSTEM:introduced=0,last_affected=29.0; WWBN AVideo <= 29.0, 29.0 and earlier.
- Is there a fix for CVE-2026-45619?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-45619 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-45619?
- Check whether you run wwbn/avideo (Packagist) or WWBN AVideo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in WWBN AVideo due to a Time-of-Check Time-of-Use (TOCTOU) race condition. While the application uses the isSSRFSafeURL() function to validate URLs, several components—including EpgParser.php and the AI plugin—fail to implement DNS pinning using the resolved IP address. An attacker can exploit this by using DNS rebinding to point a validated domain to a local or restricted IP address between the time of validation and the time of the actual request. This allows the attacker to bypass SSRF protections and access internal network resources. As of the advisory date, several call sites remain unpatched.
Affected products
- WWBN AVideo 29.0 and earlier
Identifiers
- CVE-2026-45619
- GHSA-c3ch-22rq-xfwr
Timeline
- 2026-05-11: advisory: GitHub Security Advisory published
- 2026-05-29: disclosed: NVD publication date