CVE-2026-56285

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

CVSS 4.0

7.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:N/SA:N

CVSS 3.1

8.6CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

EPSS

0.5% chance of exploitation in the next 30 days; higher than 41% of CVEs (scores of 2026-10-25)

CWEs

CWE-918, CWE-1188

Published

2026-06-29

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

References

• https://github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47
• https://github.com/zedeus/nitter/issues/1411
• https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpoint
• https://github.com/zedeus/nitter/issues/1411

Check your stackJSON