CVE-2026-56285

🗓️ 29 Jun 2026 17:13:57Reported by VulnCheckType

cve🔗 web.nvd.nist.gov👁 16 Views🌐 WEB

Nitter video proxy SSRF allows unauthenticated access to arbitrary responses via unvalidated URLs and a fixed hash key.

Reporter	Title	Published	Views	Family All 8
ATTACKERKB	CVE-2026-56285	29 Jun 202617:13	–	attackerkb
Circl	CVE-2026-56285	29 Jun 202618:52	–	circl
Cvelist	CVE-2026-56285 Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint	29 Jun 202617:13	–	cvelist
EUVD	EUVD-2026-40154	29 Jun 202617:13	–	euvd
NVD	CVE-2026-56285	29 Jun 202618:16	–	nvd
OSV	CVE-2026-56285 Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint	29 Jun 202617:13	–	osv
Positive Technologies	PT-2026-53656	29 Jun 202600:00	–	ptsecurity
Vulnrichment	CVE-2026-56285 Nitter - Server-Side Request Forgery in /video Media Proxy Endpoint	29 Jun 202617:13	–	vulnrichment

Vulners

Node

zedeus nitterRange0–44b2f096f67da2cc257a0e262a94a7ae79e95d47

[
  {
    "vendor": "zedeus",
    "product": "nitter",
    "defaultStatus": "unaffected",
    "packageURL": "pkg:github/zedeus/nitter",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "versionType": "git",
        "lessThan": "44b2f096f67da2cc257a0e262a94a7ae79e95d47"
      }
    ],
    "repo": "https://github.com/zedeus/nitter"
  }
]

Source	Link
vulncheck	www.vulncheck.com/advisories/nitter-server-side-request-forgery-in-video-media-proxy-endpoint
github	www.github.com/zedeus/nitter/issues/1411
github	www.github.com/zedeus/nitter/commit/44b2f096f67da2cc257a0e262a94a7ae79e95d47

Parameter	Position	Path	Description	CWE
url	query param	/video	Video proxy endpoint /video accepts arbitrary target URLs and uses a default HMAC key, enabling attackers to generate valid HMACs for arbitrary URLs and fetch responses from any reachable host.	CWE-1188, CWE-918

14 Jul 2026 22:17Current

5.9Medium risk

Vulners AI Score5.9

CVSS 47.7

CVSS 3.18.6

EPSS0.0036

SSVC