| Title | TufayelLUS TikTok-Video-Downloader-PHP prior to 64c0155abb88 Information Disclosure |
|---|
| Description | TikTok-Video-Downloader-PHP (TufayelLUS) disabled TLS certificate verification on all outbound HTTPS requests (CWE-295). The download script built every request with CURLOPT_SSL_VERIFYPEER = false and CURLOPT_SSL_VERIFYHOST = 0 - four occurrences in a single file - so any on-path attacker can terminate TLS, intercept the requested video URLs and tamper with downloaded content.
Fix: commit 64c0155abb88 (2026-07-09) applies the suggested patch: all 8 affected lines changed, VERIFYPEER false->true and VERIFYHOST 0->2 at all 4 sites. Maintainer acknowledgment in issue #55: "code updated with the suggested patch" (posted 35 seconds after the commit). The repository has zero tags/releases, so the version boundary is expressed against the fix commit: prior to 64c0155abb88.
Issue #55 filed 2026-07-04. No prior CVE: no advisories exist for this package in NVD or the GitHub Advisory Database.
CVSS v3.1: AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N = 7.4 (High); AC:H reflects the required on-path position. |
|---|
| Source | ⚠️ https://github.com/TufayelLUS/TikTok-Video-Downloader-PHP/issues/55 |
|---|
| User | NeoWSY (UID 82976) |
|---|
| Submission | 10/04/2026 15:45 (29 days ago) |
|---|
| Moderation | 10/18/2026 20:01 (14 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 422061 [TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d TLS index.php certificate validation] |
|---|
| Points | 20 |
|---|