PT-2026-53656 · Zedeus · Nitter

George Chen · Published 2026-06-29 · Updated 2026-06-29 · CVE-2026-56285

NVD

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including cloud metadata services and internal network resources.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-1188

CWE-918

Related Identifiers

CVE-2026-56285

Affected Products

Nitter

References · 4

• 🔥 https://github.com/zedeus/nitter/issues/1411 · Exploit
• https://github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-56285 · Security Note
• https://vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpoint · Note