CVE-2026-100901

A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Commit 6ffe823 'better security for public/stream.php' only added CURLOPT_PROTOCOLS http/https restriction and MAXREDIRS cap, does not restrict destination host. The vendor was contacted early about this disclosure but did not respond in any way.

• CWE-918

• https://gist.github.com/qianqiusujiu/87a7d7d8bd7fb53cf8529e0bafbeafba
• https://vuldb.com/cve/CVE-2026-100901
• https://vuldb.com/submit/919147
• https://vuldb.com/vuln/410851
• https://vuldb.com/vuln/410851/cti

Published

Sep 28, 2026

Last Modified

Sep 28, 2026

Status

Deferred

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-100897A security vulnerability has been detected in fuzui StudentI…5.5
• CVE-2026-100898A vulnerability was detected in DevaslanPHP project-manageme…6.3
• CVE-2026-100899A flaw has been found in DevaslanPHP project-management 1.2.…6.3
• CVE-2026-1009A stored cross-site scripting (XSS) vulnerability exists in …5.4
• CVE-2026-10090A flaw was found in the Application Subscription controller …9
• CVE-2026-100900A vulnerability has been found in DevaslanPHP project-manage…5.5
• CVE-2026-100902A vulnerability was determined in Barco ClickShare CX-20 Gen…6.5
• CVE-2026-100903A vulnerability was identified in ООО НПО Ритм GEOritm up to…5.3
• CVE-2026-100904A security vulnerability has been detected in amirsanni mini…3.5
• CVE-2026-100906A vulnerability was detected in Eyeplus 57.0.0.0308. The aff…5.3
• CVE-2026-100907A flaw has been found in Eyeplus 57.0.0.0308. The impacted e…5.3
• CVE-2026-100908A vulnerability has been found in Eyeplus 57.0.0.0308. This …7.5