PT-2026-53656 · Zedeus · Nitter

George Chen · Publicado 2026-06-29 · Atualizado 2026-06-29 · CVE-2026-56285

NVD

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-1188

CWE-918

Identificadores relacionados

CVE-2026-56285

Produtos afetados

Nitter

Referências · 4

• 🔥 https://github.com/zedeus/nitter/issues/1411 · Exploit
• https://github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47 · Correção
• https://vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpoint · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-56285 · Nota de Segurança