CVE-2026-56285CWE-1188CWE-918

Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint

High · published June 29, 2026

CVSS v4.0
7.7
EPSS
0%
Percentile
40.6
In the wild
Unconfirmed
What it is

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

The record
Technical detail
CVSS v4.0
7.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N
EPSS
0.00481 · 40.6th percentile
Weaknesses
CWE-1188 · Initialization of a Resource with an Insecure Default; CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-06-29T17:13Z
EPSS history
Timeline
  • 29 JUN 17:13Z
    Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint
    cvelistv5