CVE-2026-56285

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

State: Published
Severity: 7.7 High
Published: Jun 29, 2026
Updated: Jul 14, 2026
Reserved: Jun 20, 2026

Description

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

Scores

CVSS	Score	Vector	Source
4.0	7.7 High	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N	VulnCheck
3.1	8.6 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N	VulnCheck

Weaknesses

CWE-918 Server-Side Request Forgery (SSRF)
CWE-1188 Initialization of a Resource with an Insecure Default

Affected Products

Product	Versions
nitterzedeus	before 44b2f096f67da2cc257a0e262a94a7ae79e95d47Affected

References

Researcher Disclosureissue-tracking
Patch Commmitpatch
https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpointthird-party-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.