CVE-2026-112106 Details
Description
A security vulnerability has been detected in TufayelLUS TikTok-Video-Downloader-PHP up to c4230497bb23dd9c1f81456fe8a982d951feac0d. Affected by this issue is some unknown functionality of the file index.php of the component TLS Handler. Such manipulation leads to improper certificate validation. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The name of the patch is 64c0155abb88e714198241d41b918cefc0d5a42a. It is advisable to implement a patch to correct this issue.
A vulnerability in TufayelLUS TikTok-Video-Downloader-PHP, affecting versions prior to the patch commit 64c0155abb88e714198241d41b918cefc0d5a42a, has been identified. The issue arises in the TLS Handler component within the index.php file, where cURL requests to TikTok's servers disable essential SSL certificate validations. This flaw allows for potential man-in-the-middle attacks, where an attacker could intercept and manipulate video download links, inject malicious content, or steal session data from the user's cookies.
Users are advised to update to the version that includes the patch for this vulnerability. The patch is available in the commit 64c0155abb88e714198241d41b918cefc0d5a42a.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 19, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/TufayelLUS/TikTok-Video-Downloader-PHP/ | [email protected] | ProductVendor |
| https://github.com/TufayelLUS/TikTok-Video-Downloader-PHP/commit/64c0155abb88e714198241d41b918cefc0d5a42a | [email protected] | Source CodeVendor |
| https://github.com/TufayelLUS/TikTok-Video-Downloader-PHP/issues/55 | [email protected] | ExploitIssue TrackingRemedyVendor |
| https://vuldb.com/cve/CVE-2026-112106 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1013136 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422061 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/422061/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
| CWE-295 | Improper Certificate Validation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| TufayelLUS TikTok-Video-Downloader-PHP | <= c4230497bb23dd9c1f81456fe8a982d951feac0d |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 19, 2026 | New CVE Received | [email protected] |