WWBN AVideo, an open source video platform, contains a TOCTOU race condition vulnerability (CWE-367) in version 29.0 and earlier. The issue arises because EpgParser.php, plugin/AI/receiveAsync.json.php, and other locations fail to use the $resolvedIP out-parameter of the isSSRFSafeURL() function for DNS pinning via CURLOPT_RESOLVE. This improper handling opens the door to DNS rebinding attacks (CWE-918), where an attacker can manipulate DNS responses between the time of check and time of use, potentially bypassing security checks.

Successful exploitation could allow an attacker to bypass DNS-based security checks, potentially leading to unauthorized access or information disclosure. The CVSS 3.1 base score is 6.5 (medium), reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should monitor WWBN communications for updates. No vendor-provided mitigation or temporary workaround is currently documented.