CVE-2026-112106
Received Received - Intake

Improper Certificate Validation in TufayelLUS TikTok-Video-Downloader-PHP

Publication date: 2026-10-19

Last updated on: 2026-10-19

Assigner: VulDB

Description
A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The name of the patch is 64c0155abb88e714198241d41b918cefc0d5a42a. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-19
Last Modified
2026-10-19
Generated
2026-10-19
AI Q&A
2026-10-19
EPSS Evaluated
N/A
NVD
CVE-2026-112106
EUVD
EUVD-2026-104207

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
TufayelLUS TikTok-Video-Downloader-PHP c4230497bb23dd9c1f81456fe8a982d951feac0d

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper TLS certificate validation in the TikTok-Video-Downloader-PHP tool. The script's index.php file disables SSL verification in cURL requests, allowing man-in-the-middle attacks where attackers could intercept or manipulate data between the user and TikTok's servers.

Detection Guidance

Check if the TikTok-Video-Downloader-PHP script is installed and inspect the index.php file for disabled SSL verification in cURL functions. Look for CURLOPT_SSL_VERIFYHOST set to false or 0 and CURLOPT_SSL_VERIFYPEER set to false. Use commands like grep -r 'CURLOPT_SSL_VERIFYHOST.*false' /path/to/script or grep -r 'CURLOPT_SSL_VERIFYPEER.*false' /path/to/script to search for vulnerable configurations.

Impact Analysis

Attackers could exploit this to serve malicious video download links, inject malicious code, or steal sensitive data like cookies and session information during video downloads. The high complexity required for exploitation reduces but does not eliminate risk.

Mitigation Strategies

Update the TikTok-Video-Downloader-PHP script to the latest commit (64c0155) which enforces SSL verification by setting CURLOPT_SSL_VERIFYHOST to 2 and CURLOPT_SSL_VERIFYPEER to true. Alternatively, disable the script if not in use or replace it with a supported alternative that properly validates TLS certificates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-112106. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart