Vulnerability Description
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47
- https://github.com/zedeus/nitter/issues/1411
- https://www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video
- https://github.com/zedeus/nitter/issues/1411
FAQ
What is CVE-2026-56285?
CVE-2026-56285 is a vulnerability with a CVSS score of 8.6 (HIGH). Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitr...
How severe is CVE-2026-56285?
CVE-2026-56285 has been rated HIGH with a CVSS base score of 8.6/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-56285?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.