CVE-2026-100901
Received Received - Intake

Server-Side Request Forgery in YouTube-Downloader

Publication date: 2026-09-28

Last updated on: 2026-09-28

Assigner: VulDB

Description
A vulnerability was found in athlon1600 youtube-downloader up to 4.0.1. Affected by this vulnerability is the function stream of the file public/stream.php. The manipulation of the argument url results in server-side request forgery. It is possible to launch the attack remotely. The exploit has been made public and could be used. Commit 6ffe823 'better security for public/stream.php' only added CURLOPT_PROTOCOLS http/https restriction and MAXREDIRS cap, does not restrict destination host. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-28
Last Modified
2026-09-28
Generated
2026-09-28
AI Q&A
2026-09-28
EPSS Evaluated
N/A
NVD
CVE-2026-100901
EUVD
EUVD-2026-88068

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
athlon1600 youtube_downloader to 4.0.1 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the athlon1600 youtube-downloader tool up to version 4.0.1. The flaw exists in the public/stream.php file where the 'url' parameter is processed without proper validation. Attackers can manipulate this parameter to force the server to make unauthorized requests to internal systems or external targets.

Detection Guidance

Check for unusual outbound requests from the youtube-downloader service, particularly to internal or unexpected IP addresses. Monitor logs for requests to /public/stream.php with arbitrary URLs. Use network scanning tools to detect SSRF attempts targeting internal services or cloud metadata endpoints like 169.254.169.254.

Impact Analysis

An attacker could exploit this to access internal services, private networks, or cloud metadata endpoints like 169.254.169.254. They may retrieve sensitive data, perform network reconnaissance, or access admin panels and internal APIs. The vulnerability allows full-read SSRF with no authentication required.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Organizations may face compliance breaches if internal systems are compromised through this flaw.

Mitigation Strategies

Immediately restrict the stream.php endpoint to only accept URLs from the YouTube CDN (googlevideo.com). Add blocklists for loopback, RFC1918, link-local, and cloud metadata IPs. Disable SSL verification bypass in cURL and limit redirects to 5 or fewer. Update to the latest patched version if available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100901. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart